{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-49160", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.276Z", "datePublished": "2025-02-26T01:55:22.562Z", "dateUpdated": "2026-08-05T08:54:08.041Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:08.041Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash during module load unload test\n\nDuring purex packet handling the driver was incorrectly freeing a\npre-allocated structure. Fix this by skipping that entry.\n\nSystem crashed with the following stack during a module unload test.\n\nCall Trace:\n\tsbitmap_init_node+0x7f/0x1e0\n\tsbitmap_queue_init_node+0x24/0x150\n\tblk_mq_init_bitmaps+0x3d/0xa0\n\tblk_mq_init_tags+0x68/0x90\n\tblk_mq_alloc_map_and_rqs+0x44/0x120\n\tblk_mq_alloc_set_map_and_rqs+0x63/0x150\n\tblk_mq_alloc_tag_set+0x11b/0x230\n\tscsi_add_host_with_dma.cold+0x3f/0x245\n\tqla2x00_probe_one+0xd5a/0x1b80 [qla2xxx]\n\nCall Trace with slub_debug and debug kernel:\n\tkasan_report_invalid_free+0x50/0x80\n\t__kasan_slab_free+0x137/0x150\n\tslab_free_freelist_hook+0xc6/0x190\n\tkfree+0xe8/0x2e0\n\tqla2x00_free_device+0x3bb/0x5d0 [qla2xxx]\n\tqla2x00_remove_one+0x668/0xcf0 [qla2xxx]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - qla2xxx is a Fibre Channel HBA driver; the poisoned purex_list entry is created when the ISR receives Purex ELS/ABTS/FPIN from a SAN peer (qla24xx_copy_std_pkt → default_item) and queues it. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:H - A fabric peer can reliably arm the bug by sending Purex/ABTS so default_item stays on purex_list (especially when LOOP_READY is false or UNLOADING prevents DPC drain), but the invalid kfree only runs in qla24xx_free_purex_list during qla2x00_free_device, which requires device/module removal beyond the fabric attacker’s control.\nPR:N - Purex/ABTS/FPIN delivery and queuing are driven by unauthenticated FC frames from a fabric peer in the host driver’s ISR path, with no Linux credentials or capabilities required on the victim host.\nUI:N - No victim user action such as mounting a filesystem or opening a device is required; fabric peers emit ELS/ABTS in normal SAN operation, and teardown that frees the list occurs during routine driver remove without interactive user content handling.\nS:U - Impact remains within the host kernel authority that owns the qla2xxx driver (slab freelist corruption and crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - kfree of the embedded default_item (mid-object pointer inside scsi_host private data) is an invalid free that corrupts the slab freelist, which can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same invalid-free slab corruption enables heap spraying and control-flow/integrity compromise once the corrupted freelist is reused, as evidenced by subsequent allocation crashes during reprobe after unload.\nA:H - KASAN reports invalid free in qla2x00_free_device and the system oopses/panics on later allocations (e.g. blk_mq during qla2x00_probe_one), which is a full kernel availability loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "versions": [ { "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276", "lessThan": "9b7eb92dac240ab3bc83e188d83a3df834b41eb2", "status": "affected", "versionType": "git" }, { "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276", "lessThan": "213e57b42537f1a2e5395caa9d7189854133ed12", "status": "affected", "versionType": "git" }, { "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276", "lessThan": "67f744f73eba870ab96411d0310e831a4adc3713", "status": "affected", "versionType": "git" }, { "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276", "lessThan": "0972252450f90db56dd5415a20e2aec21a08d036", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "versions": [ { "version": "5.9", "status": "affected" }, { "version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.54", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.16.19", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.17.2", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.15.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.16.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.17.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9b7eb92dac240ab3bc83e188d83a3df834b41eb2" }, { "url": "https://git.kernel.org/stable/c/213e57b42537f1a2e5395caa9d7189854133ed12" }, { "url": "https://git.kernel.org/stable/c/67f744f73eba870ab96411d0310e831a4adc3713" }, { "url": "https://git.kernel.org/stable/c/0972252450f90db56dd5415a20e2aec21a08d036" } ], "title": "scsi: qla2xxx: Fix crash during module load unload test", "x_generator": { "engine": "bippy-1.2.0" } } } }