CVE-2023-52974: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernelbefore 4.14.306
• linux linux kernel4.15 and later · before 4.19.273
• linux linux kernel4.20 and later · before 5.4.232
• linux linux kernel5.5 and later · before 5.10.168
• linux linux kernel5.11 and later · before 5.15.93
• linux linux kernel5.16 and later · before 6.1.11
• linux linux kernel6.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 2.6.39affected
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before 496af9d3682ed4c28fb734342a09e6cc0c056ea4affected · git
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before 6abd4698f4c8a78e7bbfc421205c060c199554a0affected · git
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before d4d765f4761f9e3a2d62992f825aeee593bcb6b9affected · git
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before 9758ffe1c07b86aefd7ca8e40d9a461293427ca0affected · git
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before 0aaabdb900c7415caa2006ef580322f7eac5f6b6affected · git
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before 61e43ebfd243bcbad11be26bd921723027b77441affected · git
  • a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 and later · before f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3affected · git
  • before 2.6.39not affected · semver
  • 4.14.306 and later · up to and including 4.14.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2023-52941Mar 27, 2025 · can: isotp: split tx timer into transmission and timeout
  22Monitor
• ← EarlierCVE-2023-52973Mar 27, 2025 · vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
  31Monitor
• Later →CVE-2023-52975Mar 27, 2025 · scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress
  31Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.