BaseFortify

Publication date: 2025-10-04

Last updated on: 2026-06-01

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash when I/O abort times out While performing CPU hotplug, a crash with the following stack was seen: Call Trace: qla24xx_process_response_queue+0x42a/0x970 [qla2xxx] qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx] qla_nvme_post_cmd+0x166/0x240 [qla2xxx] nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc] blk_mq_dispatch_rq_list+0x17b/0x610 __blk_mq_sched_dispatch_requests+0xb0/0x140 blk_mq_sched_dispatch_requests+0x30/0x60 __blk_mq_run_hw_queue+0x35/0x90 __blk_mq_delay_run_hw_queue+0x161/0x180 blk_execute_rq+0xbe/0x160 __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core] nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics] nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc] nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc] process_one_work+0x1e8/0x3c0 On abort timeout, completion was called without checking if the I/O was already completed. Verify that I/O and abort request are indeed outstanding before attempting completion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-04

Last Modified

2026-06-01

Generated

2026-07-06

AI Q&A

2025-10-04

EPSS Evaluated

2026-07-04

NVD

CVE-2022-50493

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in the Linux kernel's qla2xxx SCSI driver where, during an I/O abort timeout, the system attempts to complete an I/O operation without verifying if it has already been completed. This can cause a crash, especially during CPU hotplug operations, due to improper handling of I/O and abort requests.

Impact Analysis

The vulnerability can cause the Linux kernel to crash during certain operations like CPU hotplug, potentially leading to system instability, downtime, or data loss due to improper handling of I/O abort timeouts.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version where the qla2xxx driver has been fixed to properly handle I/O abort timeouts and avoid crashes during CPU hotplug operations.

Hi! I’m here to help you understand CVE-2022-50493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70