CVE-2023-54108

What it actually does

The qla2xxx driver performed an additional DMA mapping for NVMe LS requests without checking the mapping result for errors, triggering DMA-API warnings in debug kernels; the mapping was redundant because the FC layer already handled it.

Why it matters to the business

Kernel debug warnings or potential instability on systems using QLogic Fibre Channel adapters with NVMe, increasing operational overhead for storage teams and requiring targeted kernel updates across server fleets.

How an attack unfolds

An attacker would need local or privileged access to trigger NVMe link-service requests through the qla2xxx path; no public exploitation or threat-actor campaigns are known, consistent with the low EPSS and non-KEV status.

How to fix it

Upgrade the Linux kernel to a fixed version (5.4.235 or later stable releases containing commit 3a564de3a299856f2cbd289649cea2e20d671a43). Rebuild and reboot any affected systems; no configuration changes are required.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or is at least version 5.4.235; reproduce NVMe LS traffic under a debug kernel and verify absence of the DMA-API warning.

Typical attack path

1. Gain local access to a Linux host with qla2xxx hardware
2. Issue NVMe LS commands that exercise the redundant DMA mapping path
3. Observe resulting DMA-API warnings or kernel trace output

How to detect it

Review kernel logs for the exact DMA-API warning string mentioning qla2xxx and device address 0x00000002a3ff38d8; check dmesg or journalctl on systems with QLogic adapters after NVMe traffic.

• DMA-API: qla2xxx
• qla_nvme_ls_unmap
• device driver failed to check map error

What your security team should do

• Prioritize kernel updates on any hosts exposing qla2xxx adapters within standard change windows
• Include the fixed commit hash in internal kernel build pipelines
• Monitor EPSS trend (stable at ~0.002) for any future increase