CVE-2022-50098: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path.
Following crash stack was seen:
BUG: unable to handle kernel paging request at 0000002f56aa90f8 IP: qlachkedifrxsadeletepending+0x14/0x30 [qla2xxx] Call Trace: ? qla2x00statusentry+0x19f/0x1c50 [qla2xxx] ? qla2x00startsp+0x116/0x1170 [qla2xxx] ? dmapoolalloc+0x1d6/0x210 ? mempoolalloc+0x54/0x130 ? qla24xxprocessresponsequeue+0x548/0x12b0 [qla2xxx] ? qladowork+0x2d/0x40 [qla2xxx] ? processonework+0x14c/0x390
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50098?
CVE-2022-50098 has a medium severity level as it involves potential crashes due to stale SRB access.
How do I fix CVE-2022-50098?
To fix CVE-2022-50098, update your Linux kernel to a version that has resolved the vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-50098?
CVE-2022-50098 affects Linux kernel versions from 4.10 to 5.15.61, as well as versions between 5.16 and 5.18.18, and 5.19 to 5.19.2.
What components are involved in the CVE-2022-50098 vulnerability?
CVE-2022-50098 involves the SCSI subsystem specifically related to the qla2xxx driver.
Is there a specific error condition related to CVE-2022-50098?
Yes, CVE-2022-50098 concerns I/O timeout errors that can lead to system crashes due to improper handling of SRB.