{"id":"CVE-2022-50098","state":"PUBLISHED","title":"scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts\n\nEnsure SRB is returned during I/O timeout error escalation. If that is not\npossible fail the escalation path.\n\nFollowing crash stack was seen:\n\nBUG: unable to handle kernel paging request at 0000002f56aa90f8\nIP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx]\nCall Trace:\n ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx]\n ? qla2x00_start_sp+0x116/0x1170 [qla2xxx]\n ? dma_pool_alloc+0x1d6/0x210\n ? mempool_alloc+0x54/0x130\n ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx]\n ? qla_do_work+0x2d/0x40 [qla2xxx]\n ? process_one_work+0x14c/0x390","publishedAt":"2025-06-18T11:02:35.225Z","updatedAt":"2026-10-15T21:31:18.454Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"b7bae3886a30d258b5b4fee26647043d68da3661","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"b70553175d0f94ebd73670bc16ade90bd7f7d76f","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"7dcd49c42b14717dd668fd73b503d241fdf82439","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"c39587bc0abaf16593f7abcdf8aeec3c038c7d52","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_os.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"5.15.61","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.18.18","status":"unaffected","lessThanOrEqual":"5.18.*","versionType":"semver"},{"version":"5.19.2","status":"unaffected","lessThanOrEqual":"5.19.*","versionType":"semver"},{"version":"6.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_os.c"]}],"references":["https://git.kernel.org/stable/c/b7bae3886a30d258b5b4fee26647043d68da3661","https://git.kernel.org/stable/c/b70553175d0f94ebd73670bc16ade90bd7f7d76f","https://git.kernel.org/stable/c/7dcd49c42b14717dd668fd73b503d241fdf82439","https://git.kernel.org/stable/c/c39587bc0abaf16593f7abcdf8aeec3c038c7d52"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/50xxx/CVE-2022-50098.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-50098","state":"PUBLISHED","datePublished":"2025-06-18T11:02:35.225Z","dateUpdated":"2026-10-15T21:31:18.454Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-06-18T10:57:27.412Z"},"containers":{"cna":{"title":"scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts\n\nEnsure SRB is returned during I/O timeout error escalation. If that is not\npossible fail the escalation path.\n\nFollowing crash stack was seen:\n\nBUG: unable to handle kernel paging request at 0000002f56aa90f8\nIP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx]\nCall Trace:\n ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx]\n ? qla2x00_start_sp+0x116/0x1170 [qla2xxx]\n ? dma_pool_alloc+0x1d6/0x210\n ? mempool_alloc+0x54/0x130\n ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx]\n ? qla_do_work+0x2d/0x40 [qla2xxx]\n ? process_one_work+0x14c/0x390"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"b7bae3886a30d258b5b4fee26647043d68da3661","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"b70553175d0f94ebd73670bc16ade90bd7f7d76f","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"7dcd49c42b14717dd668fd73b503d241fdf82439","versionType":"git"},{"version":"d74595278f4ab192af66d9e60a9087464638beee","status":"affected","lessThan":"c39587bc0abaf16593f7abcdf8aeec3c038c7d52","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_os.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"5.15.61","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"5.18.18","status":"unaffected","lessThanOrEqual":"5.18.*","versionType":"semver"},{"version":"5.19.2","status":"unaffected","lessThanOrEqual":"5.19.*","versionType":"semver"},{"version":"6.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/scsi/qla2xxx/qla_os.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/b7bae3886a30d258b5b4fee26647043d68da3661"},{"url":"https://git.kernel.org/stable/c/b70553175d0f94ebd73670bc16ade90bd7f7d76f"},{"url":"https://git.kernel.org/stable/c/7dcd49c42b14717dd668fd73b503d241fdf82439"},{"url":"https://git.kernel.org/stable/c/c39587bc0abaf16593f7abcdf8aeec3c038c7d52"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - qla2xxx is a Fibre Channel HBA driver; a peer on the same SAN fabric (malicious or compromised target) can stall I/O to force SCSI EH timeouts and drive port/session deletion while multi-queue SRBs remain outstanding. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - Multi-queue is enabled by default (ql2xmqsupport=1), and the fabric peer controls both I/O completion timing and port-deletion events that set fcport->deleted, so the incomplete EH wait and premature SUCCESS return are attacker-driven rather than an uncontrollable race or rare config.\nPR:N - I/O timeout handling and fcport deletion are driven by FC fabric/link and target response behavior in the host driver with no Linux credentials or capabilities required on the victim host.\nUI:N - With normal I/O to the malicious target, command timeouts automatically escalate into SCSI EH (device/target reset) and response-queue completion without any user action such as mounting or opening a device.\nS:U - Impact stays in the host kernel authority that owns the qla2xxx driver (stale SRB use-after-free and crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - The crash is stale SRB access during response processing after the SRB was not properly waited for/returned—a use-after-free on mempool-backed SRB objects that can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same mempool-backed SRB use-after-free enables heap spraying and control-flow/integrity compromise once the freed object is reclaimed, not merely a clean failure path.\nA:H - The reported BUG (kernel paging request in qla_chk_edif_rx_sa_delete_pending) is a kernel oops/panic, and any UAF on the I/O completion path reliably destabilizes the host."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T08:57:24.933Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.15.61"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.18.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-50098","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:30:13.306407Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:31:18.454Z"}}]}}}