{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50098", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.412Z", "datePublished": "2025-06-18T11:02:35.225Z", "dateUpdated": "2026-08-05T08:57:24.933Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:24.933Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts\n\nEnsure SRB is returned during I/O timeout error escalation. If that is not\npossible fail the escalation path.\n\nFollowing crash stack was seen:\n\nBUG: unable to handle kernel paging request at 0000002f56aa90f8\nIP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx]\nCall Trace:\n ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx]\n ? qla2x00_start_sp+0x116/0x1170 [qla2xxx]\n ? dma_pool_alloc+0x1d6/0x210\n ? mempool_alloc+0x54/0x130\n ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx]\n ? qla_do_work+0x2d/0x40 [qla2xxx]\n ? process_one_work+0x14c/0x390" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - qla2xxx is a Fibre Channel HBA driver; a peer on the same SAN fabric (malicious or compromised target) can stall I/O to force SCSI EH timeouts and drive port/session deletion while multi-queue SRBs remain outstanding. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - Multi-queue is enabled by default (ql2xmqsupport=1), and the fabric peer controls both I/O completion timing and port-deletion events that set fcport->deleted, so the incomplete EH wait and premature SUCCESS return are attacker-driven rather than an uncontrollable race or rare config.\nPR:N - I/O timeout handling and fcport deletion are driven by FC fabric/link and target response behavior in the host driver with no Linux credentials or capabilities required on the victim host.\nUI:N - With normal I/O to the malicious target, command timeouts automatically escalate into SCSI EH (device/target reset) and response-queue completion without any user action such as mounting or opening a device.\nS:U - Impact stays in the host kernel authority that owns the qla2xxx driver (stale SRB use-after-free and crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The crash is stale SRB access during response processing after the SRB was not properly waited for/returned—a use-after-free on mempool-backed SRB objects that can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same mempool-backed SRB use-after-free enables heap spraying and control-flow/integrity compromise once the freed object is reclaimed, not merely a clean failure path.\nA:H - The reported BUG (kernel paging request in qla_chk_edif_rx_sa_delete_pending) is a kernel oops/panic, and any UAF on the I/O completion path reliably destabilizes the host." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "versions": [ { "version": "d74595278f4ab192af66d9e60a9087464638beee", "lessThan": "b7bae3886a30d258b5b4fee26647043d68da3661", "status": "affected", "versionType": "git" }, { "version": "d74595278f4ab192af66d9e60a9087464638beee", "lessThan": "b70553175d0f94ebd73670bc16ade90bd7f7d76f", "status": "affected", "versionType": "git" }, { "version": "d74595278f4ab192af66d9e60a9087464638beee", "lessThan": "7dcd49c42b14717dd668fd73b503d241fdf82439", "status": "affected", "versionType": "git" }, { "version": "d74595278f4ab192af66d9e60a9087464638beee", "lessThan": "c39587bc0abaf16593f7abcdf8aeec3c038c7d52", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/scsi/qla2xxx/qla_os.c" ], "versions": [ { "version": "4.10", "status": "affected" }, { "version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.61", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.18", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.2", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.18.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.19.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b7bae3886a30d258b5b4fee26647043d68da3661" }, { "url": "https://git.kernel.org/stable/c/b70553175d0f94ebd73670bc16ade90bd7f7d76f" }, { "url": "https://git.kernel.org/stable/c/7dcd49c42b14717dd668fd73b503d241fdf82439" }, { "url": "https://git.kernel.org/stable/c/c39587bc0abaf16593f7abcdf8aeec3c038c7d52" } ], "title": "scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts", "x_generator": { "engine": "bippy-1.2.0" } } } }