PT-2025-8469 · Linux+5 · Linux Kernel+5

James Smart · Published 2022-01-01 · Updated 2026-03-14 · CVE-2022-49536

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock issue in the Linux kernel's SCSI I/O completion and abort handler has been identified. This issue occurs during stress I/O tests with 500+ vports, resulting in hard LOCKUP call traces. The problem arises from the incorrect ordering of lock acquisition in the lpfc abort handler routine, specifically with lpfc cmd->buf lock and phba->hbalock. This can lead to a deadlock situation between two CPUs.

Recommendations To resolve this issue, the lpfc abort handler routine should be modified to take the lpfc cmd->buf lock before phba->hbalock. This reordering prevents the deadlock situation from occurring. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2026-02223

CESA-2022_7683

CVE-2022-49536

OPENSUSE-SU-2025_1263-1

RHSA-2022:7683

RHSA-2022:8267

RHSA-2022_7683

RHSA-2022_8267

SUSE-SU-2025:01600-1

SUSE-SU-2025:1027-1

SUSE-SU-2025:1176-1

SUSE-SU-2025:1183-1

SUSE-SU-2025:1194-1

SUSE-SU-2025:1241-1

SUSE-SU-2025:1263-1

SUSE-SU-2025_01600-1

SUSE-SU-2025_1027-1

SUSE-SU-2025_1241-1

SUSE-SU-2025_1263-1

Affected Products

Astra Linux

Centos

Debian

Linux Kernel

Red Hat

Suse

References · 1475

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49536.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49536 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-49536 · Vendor Advisory
• https://git.kernel.org/stable/c/0c4eed901285b9cae36a622f32bea3e92490da6c · Patch
• https://bdu.fstec.ru/vul/2026-02223 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1183-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49536 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-49536 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49536 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49536 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:1176-1 · Vendor Advisory
• https://git.kernel.org/stable/c/03cbbd7c2f5ee288f648f4aeedc765a181188553 · Patch
• https://git.kernel.org/stable/c/7625e81de2164a082810e1f27547d388406da610 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:01600-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:1194-1 · Vendor Advisory