Improper locking in Linux kernel scsi qla2xxx driver



| Updated: 2025-05-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-49156
CWE-ID CWE-667
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper locking

EUVDB-ID: #VU104710

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49156

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qla24xx_handle_plogi_done_event() function in drivers/scsi/qla2xxx/qla_init.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.10 - 5.18 rc8

CPE2.3 External links

https://git.kernel.org/stable/c/78225d6a2a4ffdb2250ce2b7691a9e68a3f86912
https://git.kernel.org/stable/c/78612f2fe8e26637476d756a44f0f05cca0d97de
https://git.kernel.org/stable/c/7fef50214dd04427233a2e66cd624d468e67aecb
https://git.kernel.org/stable/c/826a9d4a00d1424afa961504aec6298ee92d5053
https://git.kernel.org/stable/c/afd438ff874ca40b74321b3fa19bd61adfd7ca0c
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.110
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.33
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.19
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###