CVE-2022-50215
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's SCSI generic (sg) driver. When a SCSI device is removed while it is still actively processing commands, the sg driver immediately returns an error (-ENODEV) when userspace tries to wait for those commands to complete. However, for commands using direct I/O, the data buffer may still be in use by the kernel even after this error is returned. This can lead to corrupted userspace memory for read commands or corrupted data sent to the device for write commands. The issue has been observed during iSCSI TCP session logouts, where commands may still be processed after the device removal. The fix changes the policy to allow userspace to wait for active commands to complete even if the device is being removed, returning -ENODEV only when no more responses remain.
How can this vulnerability impact me? :
This vulnerability can cause data corruption or memory corruption in userspace applications interacting with SCSI devices. Specifically, read commands may result in corrupted userspace memory, and write commands may send corrupted data to the device. This can lead to application crashes, data loss, or unreliable device behavior, especially in environments using iSCSI where devices may be removed while commands are still active.