{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50098","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-06-18T10:57:27.412Z","datePublished":"2025-06-18T11:02:35.225Z","dateUpdated":"2026-08-05T08:57:24.933Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:57:24.933Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts\n\nEnsure SRB is returned during I/O timeout error escalation. If that is not\npossible fail the escalation path.\n\nFollowing crash stack was seen:\n\nBUG: unable to handle kernel paging request at 0000002f56aa90f8\nIP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx]\nCall Trace:\n ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx]\n ? qla2x00_start_sp+0x116/0x1170 [qla2xxx]\n ? dma_pool_alloc+0x1d6/0x210\n ? mempool_alloc+0x54/0x130\n ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx]\n ? qla_do_work+0x2d/0x40 [qla2xxx]\n ? process_one_work+0x14c/0x390"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - qla2xxx is a Fibre Channel HBA driver; a peer on the same SAN fabric (malicious or compromised target) can stall I/O to force SCSI EH timeouts and drive port/session deletion while multi-queue SRBs remain outstanding. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - Multi-queue is enabled by default (ql2xmqsupport=1), and the fabric peer controls both I/O completion timing and port-deletion events that set fcport->deleted, so the incomplete EH wait and premature SUCCESS return are attacker-driven rather than an uncontrollable race or rare config.\nPR:N - I/O timeout handling and fcport deletion are driven by FC fabric/link and target response behavior in the host driver with no Linux credentials or capabilities required on the victim host.\nUI:N - With normal I/O to the malicious target, command timeouts automatically escalate into SCSI EH (device/target reset) and response-queue completion without any user action such as mounting or opening a device.\nS:U - Impact stays in the host kernel authority that owns the qla2xxx driver (stale SRB use-after-free and crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The crash is stale SRB access during response processing after the SRB was not properly waited for/returned—a use-after-free on mempool-backed SRB objects that can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same mempool-backed SRB use-after-free enables heap spraying and control-flow/integrity compromise once the freed object is reclaimed, not merely a clean failure path.\nA:H - The reported BUG (kernel paging request in qla_chk_edif_rx_sa_delete_pending) is a kernel oops/panic, and any UAF on the I/O completion path reliably destabilizes the host."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_os.c"],"versions":[{"version":"d74595278f4ab192af66d9e60a9087464638beee","lessThan":"b7bae3886a30d258b5b4fee26647043d68da3661","status":"affected","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","lessThan":"b70553175d0f94ebd73670bc16ade90bd7f7d76f","status":"affected","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","lessThan":"7dcd49c42b14717dd668fd73b503d241fdf82439","status":"affected","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","lessThan":"c39587bc0abaf16593f7abcdf8aeec3c038c7d52","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_os.c"],"versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","status":"unaffected","versionType":"semver"},{"version":"5.15.61","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"5.18.18","lessThanOrEqual":"5.18.*","status":"unaffected","versionType":"semver"},{"version":"5.19.2","lessThanOrEqual":"5.19.*","status":"unaffected","versionType":"semver"},{"version":"6.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.15.61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.18.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b7bae3886a30d258b5b4fee26647043d68da3661"},{"url":"https://git.kernel.org/stable/c/b70553175d0f94ebd73670bc16ade90bd7f7d76f"},{"url":"https://git.kernel.org/stable/c/7dcd49c42b14717dd668fd73b503d241fdf82439"},{"url":"https://git.kernel.org/stable/c/c39587bc0abaf16593f7abcdf8aeec3c038c7d52"}],"title":"scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts","x_generator":{"engine":"bippy-1.2.0"}}}}