CVE-2022-49053

A flaw was found in the Linux kernel’s SCSI target core, specifically in the TCMU (Target Core User) subsystem. The function tcmu_try_get_data_page() failed to increment the reference count on memory pages it retrieves. This allowed a use-after-free condition if another thread freed the page via tcmu_blocks_release() while it was still in use. A local, unprivileged user could exploit this flaw to trigger kernel memory corruption or a system crash. Systems using TCMU-backed SCSI targets are affected. The highest threat from this vulnerability is to system availability, with a potential risk to confidentiality and integrity depending on exploitation context.

This vulnerability is rated as Moderate impact because exploitation is restricted to local access and requires active TCMU-backed SCSI target configurations. Red Hat Enterprise Linux does not enable or load the TCMU subsystem by default; it is only activated when administrators explicitly configure user-space SCSI storage targets. Consequently, default installations that do not utilize user-space SCSI target daemons are not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.