PT-2025-41071 · Hisi Sas+2 · Hisi Sas+2

Published 2025-10-07 · Updated 2026-04-20 · CVE-2023-53627

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to SCSI operations with the hisi sas driver. Specifically, a NULL pointer dereference can occur when freeing slots, potentially triggered during traversal of the sas dev.list. This can lead to a kernel panic. The issue arises from a concurrency problem when adding and deleting members of the sas dev.list within the dereg device v3 hw() and hisi sas release tasks() functions. The root cause is the lack of proper locking mechanisms when traversing the list.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

AZL-76404

CVE-2023-53627

ECHO-9C17-74EB-E3B1

Affected Products

Debian

Linux Kernel

Hisi Sas

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53627.json · Exploit
• https://osv.dev/vulnerability/BELL-CVE-2023-53627 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76404 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2023-53627 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2023-53627 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53627 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-53627 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53627 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53627 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-53627 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53627 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53627 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53627 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1975590028400275882 · Twitter Post