AZL-58986
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-58986.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-58986
- Upstream
- Published
- 2025-02-26T07:01:29Z
- Modified
- 2026-04-01T05:19:23.956167Z
- Summary
- CVE-2022-49535 affecting package kernel for versions less than 5.15.182.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
If lpfcissueels_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference.
Similarly, when processing non-zero ELS PLOGI completion status in lpfccmplelsplogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfcdevlosstmo_handler() results in a use after free ndlp dereference.
Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling.
- References