CVE-2022-48697

A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) target driver. A local user can cause a Denial of Service (DoS) or memory corruption by triggering a use-after-free condition during the completion of target connection requests. This issue occurs when the system attempts to access memory after it has already been freed, leading to a system crash.

This vulnerability is rated as Low severity because it requires local access and specifically targets the NVMe target subsystem, which is not configured or loaded by default in standard Red Hat Enterprise Linux environments. Systems are only exposed when explicitly configured as an NVMe-over-Fabrics target accepting connection requests. Consequently, unprivileged local users cannot trigger this condition on typical deployments, limiting the potential blast radius to a localized denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.