CVE-2022-50493 (GCVE-0-2022-50493)
Vulnerability from cvelistv5
Published
2025-10-04 15:43
Modified
2026-08-05 08:58
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash when I/O abort times out While performing CPU hotplug, a crash with the following stack was seen: Call Trace: qla24xx_process_response_queue+0x42a/0x970 [qla2xxx] qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx] qla_nvme_post_cmd+0x166/0x240 [qla2xxx] nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc] blk_mq_dispatch_rq_list+0x17b/0x610 __blk_mq_sched_dispatch_requests+0xb0/0x140 blk_mq_sched_dispatch_requests+0x30/0x60 __blk_mq_run_hw_queue+0x35/0x90 __blk_mq_delay_run_hw_queue+0x161/0x180 blk_execute_rq+0xbe/0x160 __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core] nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics] nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc] nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc] process_one_work+0x1e8/0x3c0 On abort timeout, completion was called without checking if the I/O was already completed. Verify that I/O and abort request are indeed outstanding before attempting completion.
References
Impacted products
Vendor Product Version
Linux Linux Version: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12
Version: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12
Version: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12
Version: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12
Version: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12
Version: 457173c8b43ecd3ac48c8ace8d4437a50f7ad77b
Version: b7abcc7df5e131c0b4bf89cb2411c5301ee83d26
Version: 5.3.17   ≤
Version: 5.4.4   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f730e489e741c28fe6a5b3308e33c094462acb0",
              "status": "affected",
              "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
              "versionType": "git"
            },
            {
              "lessThan": "d3871af13aa03fbbe7fbb812eaf140501229a72e",
              "status": "affected",
              "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
              "versionType": "git"
            },
            {
              "lessThan": "cb4dff498468b62e8c520568559b3a9007e104d7",
              "status": "affected",
              "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
              "versionType": "git"
            },
            {
              "lessThan": "05382ed9142cf8a8a3fb662224477eecc415778b",
              "status": "affected",
              "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
              "versionType": "git"
            },
            {
              "lessThan": "68ad83188d782b2ecef2e41ac245d27e0710fe8e",
              "status": "affected",
              "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "457173c8b43ecd3ac48c8ace8d4437a50f7ad77b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b7abcc7df5e131c0b4bf89cb2411c5301ee83d26",
              "versionType": "git"
            },
            {
              "lessThan": "5.4",
              "status": "affected",
              "version": "5.3.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash when I/O abort times out\n\nWhile performing CPU hotplug, a crash with the following stack was seen:\n\nCall Trace:\n     qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]\n     qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]\n     qla_nvme_post_cmd+0x166/0x240 [qla2xxx]\n     nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]\n     blk_mq_dispatch_rq_list+0x17b/0x610\n     __blk_mq_sched_dispatch_requests+0xb0/0x140\n     blk_mq_sched_dispatch_requests+0x30/0x60\n     __blk_mq_run_hw_queue+0x35/0x90\n     __blk_mq_delay_run_hw_queue+0x161/0x180\n     blk_execute_rq+0xbe/0x160\n     __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]\n     nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]\n     nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]\n     nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]\n     process_one_work+0x1e8/0x3c0\n\nOn abort timeout, completion was called without checking if the I/O was\nalready completed.\n\nVerify that I/O and abort request are indeed outstanding before attempting\ncompletion."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - qla2xxx is a Fibre Channel HBA driver; a peer on the same SAN fabric (malicious or compromised target) can stall I/O and abort responses so the host issues an abort and then hits qla24xx_abort_iocb_timeout. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - The adjacent peer controls when I/O and abort complete relative to the fixed abort timer, and can complete the original command while delaying the abort IOCB so the timeout path runs after the SRB is already done. No uncontrollable race or rare config is required once that sequence is driven.\nPR:N - Fabric/link and target response timing are processed in the host driver without Linux credentials or capabilities on the victim. The attacker needs no local account on the vulnerable host.\nUI:N - No victim user action is required; with normal I/O to the malicious target, timeout and abort handling run automatically in the driver.\nS:U - Impact stays in the host kernel authority (SRB double-completion / heap UAF and crash). This is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Double-calling done() on an SRB already removed from outstanding_cmds and freed back to the SRB mempool is a use-after-free, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same double-completion UAF of a mempool-backed SRB enables heap reuse and control-flow/integrity compromise, not merely a clean failure path.\nA:H - The reported crash and any UAF-driven oops/panic or hang make availability High; double scsi_done/kref_put paths reliably destabilize the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:58.686Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f730e489e741c28fe6a5b3308e33c094462acb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3871af13aa03fbbe7fbb812eaf140501229a72e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b"
        },
        {
          "url": "https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e"
        }
      ],
      "title": "scsi: qla2xxx: Fix crash when I/O abort times out",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50493",
    "datePublished": "2025-10-04T15:43:45.895Z",
    "dateReserved": "2025-10-04T15:39:19.464Z",
    "dateUpdated": "2026-08-05T08:58:58.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.