CVE-2022-50493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-50493", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-04T15:39:19.464Z", "datePublished": "2025-10-04T15:43:45.895Z", "dateUpdated": "2026-10-15T21:41:21.723Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:58:58.686Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash when I/O abort times out\n\nWhile performing CPU hotplug, a crash with the following stack was seen:\n\nCall Trace:\n qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]\n qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]\n qla_nvme_post_cmd+0x166/0x240 [qla2xxx]\n nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]\n blk_mq_dispatch_rq_list+0x17b/0x610\n __blk_mq_sched_dispatch_requests+0xb0/0x140\n blk_mq_sched_dispatch_requests+0x30/0x60\n __blk_mq_run_hw_queue+0x35/0x90\n __blk_mq_delay_run_hw_queue+0x161/0x180\n blk_execute_rq+0xbe/0x160\n __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]\n nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]\n nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]\n nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]\n process_one_work+0x1e8/0x3c0\n\nOn abort timeout, completion was called without checking if the I/O was\nalready completed.\n\nVerify that I/O and abort request are indeed outstanding before attempting\ncompletion."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - qla2xxx is a Fibre Channel HBA driver; a peer on the same SAN fabric (malicious or compromised target) can stall I/O and abort responses so the host issues an abort and then hits qla24xx_abort_iocb_timeout. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - The adjacent peer controls when I/O and abort complete relative to the fixed abort timer, and can complete the original command while delaying the abort IOCB so the timeout path runs after the SRB is already done. No uncontrollable race or rare config is required once that sequence is driven.\nPR:N - Fabric/link and target response timing are processed in the host driver without Linux credentials or capabilities on the victim. The attacker needs no local account on the vulnerable host.\nUI:N - No victim user action is required; with normal I/O to the malicious target, timeout and abort handling run automatically in the driver.\nS:U - Impact stays in the host kernel authority (SRB double-completion / heap UAF and crash). This is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Double-calling done() on an SRB already removed from outstanding_cmds and freed back to the SRB mempool is a use-after-free, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same double-completion UAF of a mempool-backed SRB enables heap reuse and control-flow/integrity compromise, not merely a clean failure path.\nA:H - The reported crash and any UAF-driven oops/panic or hang make availability High; double scsi_done/kref_put paths reliably destabilize the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/qla2xxx/qla_init.c"], "versions": [{"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "5f730e489e741c28fe6a5b3308e33c094462acb0", "status": "affected", "versionType": "git"}, {"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "d3871af13aa03fbbe7fbb812eaf140501229a72e", "status": "affected", "versionType": "git"}, {"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "cb4dff498468b62e8c520568559b3a9007e104d7", "status": "affected", "versionType": "git"}, {"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "05382ed9142cf8a8a3fb662224477eecc415778b", "status": "affected", "versionType": "git"}, {"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "68ad83188d782b2ecef2e41ac245d27e0710fe8e", "status": "affected", "versionType": "git"}, {"version": "457173c8b43ecd3ac48c8ace8d4437a50f7ad77b", "status": "affected", "versionType": "git"}, {"version": "b7abcc7df5e131c0b4bf89cb2411c5301ee83d26", "status": "affected", "versionType": "git"}, {"version": "5.3.17", "lessThan": "5.4", "status": "affected", "versionType": "semver"}, {"version": "5.4.4", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/qla2xxx/qla_init.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.86", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0.16", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.2", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.0.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5f730e489e741c28fe6a5b3308e33c094462acb0"}, {"url": "https://git.kernel.org/stable/c/d3871af13aa03fbbe7fbb812eaf140501229a72e"}, {"url": "https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7"}, {"url": "https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b"}, {"url": "https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e"}], "title": "scsi: qla2xxx: Fix crash when I/O abort times out", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:31:36.546420Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:21.723Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-50493", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:31:36.546420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:31:37.459Z"}}], "cna": {"title": "scsi: qla2xxx: Fix crash when I/O abort times out", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - qla2xxx is a Fibre Channel HBA driver; a peer on the same SAN fabric (malicious or compromised target) can stall I/O and abort responses so the host issues an abort and then hits qla24xx_abort_iocb_timeout. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:L - The adjacent peer controls when I/O and abort complete relative to the fixed abort timer, and can complete the original command while delaying the abort IOCB so the timeout path runs after the SRB is already done. No uncontrollable race or rare config is required once that sequence is driven.\nPR:N - Fabric/link and target response timing are processed in the host driver without Linux credentials or capabilities on the victim. The attacker needs no local account on the vulnerable host.\nUI:N - No victim user action is required; with normal I/O to the malicious target, timeout and abort handling run automatically in the driver.\nS:U - Impact stays in the host kernel authority (SRB double-completion / heap UAF and crash). This is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Double-calling done() on an SRB already removed from outstanding_cmds and freed back to the SRB mempool is a use-after-free, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same double-completion UAF of a mempool-backed SRB enables heap reuse and control-flow/integrity compromise, not merely a clean failure path.\nA:H - The reported crash and any UAF-driven oops/panic or hang make availability High; double scsi_done/kref_put paths reliably destabilize the host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "5f730e489e741c28fe6a5b3308e33c094462acb0", "versionType": "git"}, {"status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "d3871af13aa03fbbe7fbb812eaf140501229a72e", "versionType": "git"}, {"status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "cb4dff498468b62e8c520568559b3a9007e104d7", "versionType": "git"}, {"status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "05382ed9142cf8a8a3fb662224477eecc415778b", "versionType": "git"}, {"status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "lessThan": "68ad83188d782b2ecef2e41ac245d27e0710fe8e", "versionType": "git"}, {"status": "affected", "version": "457173c8b43ecd3ac48c8ace8d4437a50f7ad77b", "versionType": "git"}, {"status": "affected", "version": "b7abcc7df5e131c0b4bf89cb2411c5301ee83d26", "versionType": "git"}, {"status": "affected", "version": "5.3.17", "lessThan": "5.4", "versionType": "semver"}, {"status": "affected", "version": "5.4.4", "lessThan": "5.5", "versionType": "semver"}], "programFiles": ["drivers/scsi/qla2xxx/qla_init.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.86", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.0.16", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1.2", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/scsi/qla2xxx/qla_init.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5f730e489e741c28fe6a5b3308e33c094462acb0"}, {"url": "https://git.kernel.org/stable/c/d3871af13aa03fbbe7fbb812eaf140501229a72e"}, {"url": "https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7"}, {"url": "https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b"}, {"url": "https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash when I/O abort times out\n\nWhile performing CPU hotplug, a crash with the following stack was seen:\n\nCall Trace:\n qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]\n qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]\n qla_nvme_post_cmd+0x166/0x240 [qla2xxx]\n nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]\n blk_mq_dispatch_rq_list+0x17b/0x610\n __blk_mq_sched_dispatch_requests+0xb0/0x140\n blk_mq_sched_dispatch_requests+0x30/0x60\n __blk_mq_run_hw_queue+0x35/0x90\n __blk_mq_delay_run_hw_queue+0x161/0x180\n blk_execute_rq+0xbe/0x160\n __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]\n nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]\n nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]\n nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]\n process_one_work+0x1e8/0x3c0\n\nOn abort timeout, completion was called without checking if the I/O was\nalready completed.\n\nVerify that I/O and abort request are indeed outstanding before attempting\ncompletion."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.86", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.16", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.2", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.2", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.3.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:58:58.686Z"}}}, "cveMetadata": {"cveId": "CVE-2022-50493", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:21.723Z", "dateReserved": "2025-10-04T15:39:19.464Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-04T15:43:45.895Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/qla2xxx/qla_init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5f730e489e741c28fe6a5b3308e33c094462acb0", "status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "versionType": "git"}, {"lessThan": "d3871af13aa03fbbe7fbb812eaf140501229a72e", "status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "versionType": "git"}, {"lessThan": "cb4dff498468b62e8c520568559b3a9007e104d7", "status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "versionType": "git"}, {"lessThan": "05382ed9142cf8a8a3fb662224477eecc415778b", "status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "versionType": "git"}, {"lessThan": "68ad83188d782b2ecef2e41ac245d27e0710fe8e", "status": "affected", "version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12", "versionType": "git"}, {"status": "affected", "version": "457173c8b43ecd3ac48c8ace8d4437a50f7ad77b", "versionType": "git"}, {"status": "affected", "version": "b7abcc7df5e131c0b4bf89cb2411c5301ee83d26", "versionType": "git"}, {"lessThan": "5.4", "status": "affected", "version": "5.3.17", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/qla2xxx/qla_init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.86", "versionType": "semver"}, {"lessThanOrEqual": "6.0.*", "status": "unaffected", "version": "6.0.16", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "52607F53-FDC9-4FD7-8CD9-7911AF5733F2", "versionEndExcluding": "5.4", "versionStartIncluding": "5.3.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD782530-D591-4DEB-9E5C-4361F5C2FF59", "versionEndExcluding": "5.15.86", "versionStartIncluding": "5.4.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C720A569-3D93-4D77-95F6-E2B3A3267D9F", "versionEndExcluding": "6.0.16", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "77239F4B-6BB2-4B9E-A654-36A52396116C", "versionEndExcluding": "6.1.2", "versionStartIncluding": "6.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash when I/O abort times out\n\nWhile performing CPU hotplug, a crash with the following stack was seen:\n\nCall Trace:\n qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]\n qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]\n qla_nvme_post_cmd+0x166/0x240 [qla2xxx]\n nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]\n blk_mq_dispatch_rq_list+0x17b/0x610\n __blk_mq_sched_dispatch_requests+0xb0/0x140\n blk_mq_sched_dispatch_requests+0x30/0x60\n __blk_mq_run_hw_queue+0x35/0x90\n __blk_mq_delay_run_hw_queue+0x161/0x180\n blk_execute_rq+0xbe/0x160\n __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]\n nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]\n nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]\n nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]\n process_one_work+0x1e8/0x3c0\n\nOn abort timeout, completion was called without checking if the I/O was\nalready completed.\n\nVerify that I/O and abort request are indeed outstanding before attempting\ncompletion."}], "id": "CVE-2022-50493", "lastModified": "2026-10-15T22:17:31.350", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-50493", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:31:36.546420Z", "version": "2.0.3"}}]}, "published": "2025-10-04T16:15:46.300", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f730e489e741c28fe6a5b3308e33c094462acb0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d3871af13aa03fbbe7fbb812eaf140501229a72e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: scsi: qla2xxx: Fix crash when I/O abort times out", "id": "2401516", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2401516"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: qla2xxx: Fix crash when I/O abort times out\nWhile performing CPU hotplug, a crash with the following stack was seen:\nCall Trace:\nqla24xx_process_response_queue+0x42a/0x970 [qla2xxx]\nqla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]\nqla_nvme_post_cmd+0x166/0x240 [qla2xxx]\nnvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]\nblk_mq_dispatch_rq_list+0x17b/0x610\n__blk_mq_sched_dispatch_requests+0xb0/0x140\nblk_mq_sched_dispatch_requests+0x30/0x60\n__blk_mq_run_hw_queue+0x35/0x90\n__blk_mq_delay_run_hw_queue+0x161/0x180\nblk_execute_rq+0xbe/0x160\n__nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]\nnvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]\nnvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]\nnvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]\nprocess_one_work+0x1e8/0x3c0\nOn abort timeout, completion was called without checking if the I/O was\nalready completed.\nVerify that I/O and abort request are indeed outstanding before attempting\ncompletion."], "name": "CVE-2022-50493", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-50493\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-50493\nhttps://lore.kernel.org/linux-cve-announce/2025100418-CVE-2022-50493-2b70@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-06T14:41:03.847734+00:00", "updated": "2025-10-06T14:41:03.847798+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}