PT-2025-8468 · Linux+4 · Linux Kernel+4
James Smart
·
Published
2022-01-01
·
Updated
2026-05-26
·
CVE-2022-49535
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A null pointer dereference issue has been identified in the Linux kernel, specifically in the lpfc driver. This issue occurs when the
lpfc issue els flogi() function fails and returns a non-zero status, causing the node reference count to be decremented prematurely. If there are pending registrations or dev-loss-evt work, the node may be released too early, resulting in a use-after-free null pointer dereference. A similar issue arises when processing non-zero ELS PLOGI completion status in lpfc cmpl els plogi(), where the node may be released prematurely, leading to a use-after-free ndlp dereference.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu