CVE-2022-50098: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts

Q: What is the severity of CVE-2022-50098?

CVE-2022-50098 has a medium severity level as it involves potential crashes due to stale SRB access.

Q: How do I fix CVE-2022-50098?

To fix CVE-2022-50098, update your Linux kernel to a version that has resolved the vulnerability.

Q: Which versions of the Linux kernel are affected by CVE-2022-50098?

CVE-2022-50098 affects Linux kernel versions from 4.10 to 5.15.61, as well as versions between 5.16 and 5.18.18, and 5.19 to 5.19.2.

Q: What components are involved in the CVE-2022-50098 vulnerability?

CVE-2022-50098 involves the SCSI subsystem specifically related to the qla2xxx driver.

Q: Is there a specific error condition related to CVE-2022-50098?

Yes, CVE-2022-50098 concerns I/O timeout errors that can lead to system crashes due to improper handling of SRB.

Published Jun 18, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts

Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path.

Following crash stack was seen:

BUG: unable to handle kernel paging request at 0000002f56aa90f8 IP: qlachkedifrxsadeletepending+0x14/0x30 [qla2xxx] Call Trace: ? qla2x00statusentry+0x19f/0x1c50 [qla2xxx] ? qla2x00startsp+0x116/0x1170 [qla2xxx] ? dmapoolalloc+0x1d6/0x210 ? mempoolalloc+0x54/0x130 ? qla24xxprocessresponsequeue+0x548/0x12b0 [qla2xxx] ? qladowork+0x2d/0x40 [qla2xxx] ? processonework+0x14c/0x390

Affected Software

158 affected componentsFixes available

Linux Kernel

Linux Linux kernel>=4.10<5.15.61

Linux Linux kernel>=5.16<5.18.18

Linux Linux kernel>=5.19<5.19.2

debian/linux<5.19.6-1

5.19.6-1

debian/linux<5.19.6-1

5.19.6-1

debian/linux<5.19.6-1

5.19.6-1

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

ubuntu/linux-azure*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oracle*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-5.15<5.15.0-1023.27~20.04.1

5.15.0-1023.27~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1023.29~20.04.1

5.15.0-1023.29~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1022.29~20.04.1

5.15.0-1022.29~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-53.59~20.04.1

5.15.0-53.59~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1018.23~20.04.1

5.15.0-1018.23~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-53.59~20.04.1

5.15.0-53.59~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1022.28~20.04.1

5.15.0-1022.28~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1023.27~20.04.1

5.15.0-1023.27~20.04.1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-intel-5.13*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-53.59

5.15.0-53.59

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1023.27

5.15.0-1023.27

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-azure<5.15.0-1023.29

5.15.0-1023.29

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-fde<5.15.0-1024.30.1

5.15.0-1024.30.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1022.29

5.15.0-1022.29

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gke<5.15.0-1020.25

5.15.0-1020.25

ubuntu/linux-gkeop<5.15.0-1008.12

5.15.0-1008.12

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1018.21

5.15.0-1018.21

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1018.23

5.15.0-1018.23

ubuntu/linux-kvm<5.15.0-1021.26

5.15.0-1021.26

ubuntu/linux-lowlatency<5.15.0-53.59

5.15.0-53.59

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-nvidia<5.15.0-1015.15

5.15.0-1015.15

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1022.28

5.15.0-1022.28

ubuntu/linux-oracle-6.5*

ubuntu/linux-raspi<5.15.0-1018.20

5.15.0-1018.20

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-realtime<5.15.0-1025.28

5.15.0-1025.28

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.19.6-1
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.27~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.29~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.29~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-53.59~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1018.23~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-53.59~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.28~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.27~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-53.59
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.27
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1023.29
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1024.30.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.29
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1020.25
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1008.12
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1018.21
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1018.23
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.26
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-53.59
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1015.15
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1022.28
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1018.20
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.28
Compensating control
For qla2xxx I/O timeout error escalation, ensure the SRB is returned; if returning the SRB is not possible, fail the escalation path.

Event History

Jun 18, 2025

CVE Published

via MITRE·11:02 AM

Data Sourced

via MITRE·11:02 AM

DescriptionSeverity

Data Sourced

via OSV·11:15 AM

DescriptionSeverityAffected Software

Data Sourced

via NVD·11:15 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-50098?

CVE-2022-50098 has a medium severity level as it involves potential crashes due to stale SRB access.

How do I fix CVE-2022-50098?

To fix CVE-2022-50098, update your Linux kernel to a version that has resolved the vulnerability.

Which versions of the Linux kernel are affected by CVE-2022-50098?

CVE-2022-50098 affects Linux kernel versions from 4.10 to 5.15.61, as well as versions between 5.16 and 5.18.18, and 5.19 to 5.19.2.

What components are involved in the CVE-2022-50098 vulnerability?

CVE-2022-50098 involves the SCSI subsystem specifically related to the qla2xxx driver.

Is there a specific error condition related to CVE-2022-50098?

Yes, CVE-2022-50098 concerns I/O timeout errors that can lead to system crashes due to improper handling of SRB.

CVE-2022-50098: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2022-50098?

How do I fix CVE-2022-50098?

Which versions of the Linux kernel are affected by CVE-2022-50098?

What components are involved in the CVE-2022-50098 vulnerability?

Is there a specific error condition related to CVE-2022-50098?

Company

Resources

Contact