GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49160 (GCVE-0-2022-49160)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-08-05 08:54
VLAI
Title
scsi: qla2xxx: Fix crash during module load unload test
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping that entry. System crashed with the following stack during a module unload test. Call Trace: sbitmap_init_node+0x7f/0x1e0 sbitmap_queue_init_node+0x24/0x150 blk_mq_init_bitmaps+0x3d/0xa0 blk_mq_init_tags+0x68/0x90 blk_mq_alloc_map_and_rqs+0x44/0x120 blk_mq_alloc_set_map_and_rqs+0x63/0x150 blk_mq_alloc_tag_set+0x11b/0x230 scsi_add_host_with_dma.cold+0x3f/0x245 qla2x00_probe_one+0xd5a/0x1b80 [qla2xxx] Call Trace with slub_debug and debug kernel: kasan_report_invalid_free+0x50/0x80 __kasan_slab_free+0x137/0x150 slab_free_freelist_hook+0xc6/0x190 kfree+0xe8/0x2e0 qla2x00_free_device+0x3bb/0x5d0 [qla2xxx] qla2x00_remove_one+0x668/0xcf0 [qla2xxx]
Severity
7.5 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 62e9dd177732843ae6c5b9d2ed61e7c9538fa276 , < 9b7eb92dac240ab3bc83e188d83a3df834b41eb2 (git)
Affected: 62e9dd177732843ae6c5b9d2ed61e7c9538fa276 , < 213e57b42537f1a2e5395caa9d7189854133ed12 (git)
Affected: 62e9dd177732843ae6c5b9d2ed61e7c9538fa276 , < 67f744f73eba870ab96411d0310e831a4adc3713 (git)
Affected: 62e9dd177732843ae6c5b9d2ed61e7c9538fa276 , < 0972252450f90db56dd5415a20e2aec21a08d036 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.15.54 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b7eb92dac240ab3bc83e188d83a3df834b41eb2",
              "status": "affected",
              "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
              "versionType": "git"
            },
            {
              "lessThan": "213e57b42537f1a2e5395caa9d7189854133ed12",
              "status": "affected",
              "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
              "versionType": "git"
            },
            {
              "lessThan": "67f744f73eba870ab96411d0310e831a4adc3713",
              "status": "affected",
              "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
              "versionType": "git"
            },
            {
              "lessThan": "0972252450f90db56dd5415a20e2aec21a08d036",
              "status": "affected",
              "version": "62e9dd177732843ae6c5b9d2ed61e7c9538fa276",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.54",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash during module load unload test\n\nDuring purex packet handling the driver was incorrectly freeing a\npre-allocated structure. Fix this by skipping that entry.\n\nSystem crashed with the following stack during a module unload test.\n\nCall Trace:\n\tsbitmap_init_node+0x7f/0x1e0\n\tsbitmap_queue_init_node+0x24/0x150\n\tblk_mq_init_bitmaps+0x3d/0xa0\n\tblk_mq_init_tags+0x68/0x90\n\tblk_mq_alloc_map_and_rqs+0x44/0x120\n\tblk_mq_alloc_set_map_and_rqs+0x63/0x150\n\tblk_mq_alloc_tag_set+0x11b/0x230\n\tscsi_add_host_with_dma.cold+0x3f/0x245\n\tqla2x00_probe_one+0xd5a/0x1b80 [qla2xxx]\n\nCall Trace with slub_debug and debug kernel:\n\tkasan_report_invalid_free+0x50/0x80\n\t__kasan_slab_free+0x137/0x150\n\tslab_free_freelist_hook+0xc6/0x190\n\tkfree+0xe8/0x2e0\n\tqla2x00_free_device+0x3bb/0x5d0 [qla2xxx]\n\tqla2x00_remove_one+0x668/0xcf0 [qla2xxx]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - qla2xxx is a Fibre Channel HBA driver; the poisoned purex_list entry is created when the ISR receives Purex ELS/ABTS/FPIN from a SAN peer (qla24xx_copy_std_pkt \u2192 default_item) and queues it. FC is a non-routable fabric, so Adjacent is the highest defensible vector.\nAC:H - A fabric peer can reliably arm the bug by sending Purex/ABTS so default_item stays on purex_list (especially when LOOP_READY is false or UNLOADING prevents DPC drain), but the invalid kfree only runs in qla24xx_free_purex_list during qla2x00_free_device, which requires device/module removal beyond the fabric attacker\u2019s control.\nPR:N - Purex/ABTS/FPIN delivery and queuing are driven by unauthenticated FC frames from a fabric peer in the host driver\u2019s ISR path, with no Linux credentials or capabilities required on the victim host.\nUI:N - No victim user action such as mounting a filesystem or opening a device is required; fabric peers emit ELS/ABTS in normal SAN operation, and teardown that frees the list occurs during routine driver remove without interactive user content handling.\nS:U - Impact remains within the host kernel authority that owns the qla2xxx driver (slab freelist corruption and crash); this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - kfree of the embedded default_item (mid-object pointer inside scsi_host private data) is an invalid free that corrupts the slab freelist, which can be leveraged for arbitrary kernel memory disclosure via heap reuse.\nI:H - The same invalid-free slab corruption enables heap spraying and control-flow/integrity compromise once the corrupted freelist is reused, as evidenced by subsequent allocation crashes during reprobe after unload.\nA:H - KASAN reports invalid free in qla2x00_free_device and the system oopses/panics on later allocations (e.g. blk_mq during qla2x00_probe_one), which is a full kernel availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:08.041Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b7eb92dac240ab3bc83e188d83a3df834b41eb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/213e57b42537f1a2e5395caa9d7189854133ed12"
        },
        {
          "url": "https://git.kernel.org/stable/c/67f744f73eba870ab96411d0310e831a4adc3713"
        },
        {
          "url": "https://git.kernel.org/stable/c/0972252450f90db56dd5415a20e2aec21a08d036"
        }
      ],
      "title": "scsi: qla2xxx: Fix crash during module load unload test",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49160",
    "datePublished": "2025-02-26T01:55:22.562Z",
    "dateReserved": "2025-02-26T01:49:39.276Z",
    "dateUpdated": "2026-08-05T08:54:08.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49160",
      "date": "2026-09-14",
      "epss": "0.00327",
      "percentile": "0.25634"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49160\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:53.190\",\"lastModified\":\"2026-08-04T10:17:36.883\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix crash during module load unload test\\n\\nDuring purex packet handling the driver was incorrectly freeing a\\npre-allocated structure. Fix this by skipping that entry.\\n\\nSystem crashed with the following stack during a module unload test.\\n\\nCall Trace:\\n\\tsbitmap_init_node+0x7f/0x1e0\\n\\tsbitmap_queue_init_node+0x24/0x150\\n\\tblk_mq_init_bitmaps+0x3d/0xa0\\n\\tblk_mq_init_tags+0x68/0x90\\n\\tblk_mq_alloc_map_and_rqs+0x44/0x120\\n\\tblk_mq_alloc_set_map_and_rqs+0x63/0x150\\n\\tblk_mq_alloc_tag_set+0x11b/0x230\\n\\tscsi_add_host_with_dma.cold+0x3f/0x245\\n\\tqla2x00_probe_one+0xd5a/0x1b80 [qla2xxx]\\n\\nCall Trace with slub_debug and debug kernel:\\n\\tkasan_report_invalid_free+0x50/0x80\\n\\t__kasan_slab_free+0x137/0x150\\n\\tslab_free_freelist_hook+0xc6/0x190\\n\\tkfree+0xe8/0x2e0\\n\\tqla2x00_free_device+0x3bb/0x5d0 [qla2xxx]\\n\\tqla2x00_remove_one+0x668/0xcf0 [qla2xxx]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: qla2xxx: Se corrige un fallo durante la prueba de carga y descarga de m\u00f3dulos. Durante la gesti\u00f3n de paquetes de Purex, el controlador estaba liberando incorrectamente una estructura preasignada. Solucione este problema omitiendo esa entrada. El sistema se bloqueaba con la siguiente pila durante una prueba de descarga de m\u00f3dulos. Rastreo de llamadas: sbitmap_init_node+0x7f/0x1e0 sbitmap_queue_init_node+0x24/0x150 blk_mq_init_bitmaps+0x3d/0xa0 blk_mq_init_tags+0x68/0x90 blk_mq_alloc_map_and_rqs+0x44/0x120 blk_mq_alloc_set_map_and_rqs+0x63/0x150 blk_mq_alloc_tag_set+0x11b/0x230 scsi_add_host_with_dma.cold+0x3f/0x245 qla2x00_probe_one+0xd5a/0x1b80 [qla2xxx] Rastreo de llamadas con slub_debug y n\u00facleo de depuraci\u00f3n: kasan_report_invalid_free+0x50/0x80 __kasan_slab_free+0x137/0x150 slab_free_freelist_hook+0xc6/0x190 kfree+0xe8/0x2e0 qla2x00_free_device+0x3bb/0x5d0 [qla2xxx] qla2x00_remove_one+0x668/0xcf0 [qla2xxx]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"62e9dd177732843ae6c5b9d2ed61e7c9538fa276\",\"lessThan\":\"9b7eb92dac240ab3bc83e188d83a3df834b41eb2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62e9dd177732843ae6c5b9d2ed61e7c9538fa276\",\"lessThan\":\"213e57b42537f1a2e5395caa9d7189854133ed12\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62e9dd177732843ae6c5b9d2ed61e7c9538fa276\",\"lessThan\":\"67f744f73eba870ab96411d0310e831a4adc3713\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62e9dd177732843ae6c5b9d2ed61e7c9538fa276\",\"lessThan\":\"0972252450f90db56dd5415a20e2aec21a08d036\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.54\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-763\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.15.54\",\"matchCriteriaId\":\"708DCCCF-C8E9-43AD-A089-AE3BB40C6369\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0972252450f90db56dd5415a20e2aec21a08d036\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/213e57b42537f1a2e5395caa9d7189854133ed12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/67f744f73eba870ab96411d0310e831a4adc3713\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9b7eb92dac240ab3bc83e188d83a3df834b41eb2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:46:34+00:00",
      "cve": "CVE-2022-49160",
      "id": "CVE-2022-49160",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "286",
      "product_status:known_affected": "80",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: qla2xxx: Fix crash during module load unload test",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49160.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:37:05Z",
      "cve": "CVE-2022-49160",
      "id": "CVE-2022-49160",
      "initial_release_date": "2025-02-27T03:11:21Z",
      "product_status:known_affected": "421",
      "product_status:known_not_affected": "232",
      "product_status:recommended": "361",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49160",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49160.json",
      "version": "54"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.