CVE-2023-54014

What it actually does

Missing validation allows fc_bsg_to_rport() to return NULL which is then dereferenced in the qla2xxx SCSI driver BSG handler, resulting in a kernel NULL pointer dereference.

Why it matters to the business

Kernel panic or system crash can cause unplanned downtime on storage-connected Linux hosts; low exploitability and narrow affected surface limit widespread operational risk.

How an attack unfolds

An attacker with local access crafts a BSG request that causes fc_bsg_to_rport() to return NULL; the unchecked pointer is then dereferenced inside the qla2xxx driver, triggering a kernel oops or panic.

How to fix it

Update affected Linux kernel trees to commit f35bd94b4e11c41de90cd0fa72c9062e8196822f or later; update docker-machine-driver-harvester packages to version 1.0.2-r2 or newer in Chainguard and Wolfi distributions.

How to confirm the fix worked

Confirm the presence of the added NULL check after the fc_bsg_to_rport() call in the qla2xxx BSG handler; verify kernel version or package version matches a fixed release.

Typical attack path

1. Obtain local shell or user context on a system using the qla2xxx driver
2. Issue a crafted BSG ioctl or FC BSG request that triggers the NULL return path
3. Trigger NULL dereference leading to kernel panic or denial of service

How to detect it

Review kernel logs for oops or panic entries referencing qla2xxx and fc_bsg_to_rport; examine audit or system call logs for unusual BSG ioctl activity on Fibre Channel devices.

What your security team should do

• Prioritize patching kernel packages on hosts that use QLogic Fibre Channel HBAs
• Apply the listed fixed versions or commit hashes during the next maintenance window
• Monitor for kernel oops or panic events on storage servers until patches are deployed