PT-2025-8084 · Linux+4 · Linux Kernel+4

Quinn Tran · Published 2022-01-24 · Updated 2025-09-29 · CVE-2022-49156

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability in the Linux kernel has been resolved. The issue occurs in the scsi: qla2xxx driver, where a call to the midlayer function fc remote port delete can put the thread to sleep while in interrupt context, triggering a crash. The problem arises from scheduling while atomic. To address this, the call is scheduled in non-interrupt context for safety.

Recommendations As a temporary workaround, consider disabling the interrupt context for the fc remote port delete function call until a patch is available. Restrict access to the qla2xxx driver to minimize the risk of exploitation. Avoid using the qla2x00 schedule rport del function in the affected kernel until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Weakness Enumeration

CWE-121

CWE-99

Related Identifiers

ALSA-2025_16880

BDU:2026-01544

CESA-2022_7683

CVE-2022-49156

OPENSUSE-SU-2025_1263-1

RHSA-2022:7683

RHSA-2022:8267

RHSA-2022_7683

RHSA-2022_8267

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025:1293-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

SUSE-SU-2025_1293-1

Affected Products

Astra Linux

Centos

Linux Kernel

Red Hat

Suse

References · 1500

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49156.json · Exploit
• https://git.kernel.org/stable/c/afd438ff874ca40b74321b3fa19bd61adfd7ca0c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49156 · Vendor Advisory
• https://git.kernel.org/stable/c/78612f2fe8e26637476d756a44f0f05cca0d97de · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1293-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49156 · Vendor Advisory
• https://git.kernel.org/stable/c/7fef50214dd04427233a2e66cd624d468e67aecb · Patch
• https://git.kernel.org/stable/c/78225d6a2a4ffdb2250ce2b7691a9e68a3f86912 · Patch
• https://osv.dev/vulnerability/CVE-2022-49156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49156 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49156 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1194-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1241-1 · Vendor Advisory