CVE-2022-49082

A flaw was found in the Linux kernel’s mpt3sas driver when removing SAS expander nodes. During the removal process, the driver may access a memory region after it has been freed. This results in a use-after-free condition that a local, unprivileged user could exploit to cause a system crash or escalate privileges. The highest threat from this vulnerability is to system availability, with a possible impact on confidentiality and integrity. The issue has been addressed by ensuring memory is not accessed after being released.

Red Hat has assigned this vulnerability a Moderate severity rating with a CVSSv3.1 score of 5.5. This assessment is based on the following key factors:

• Triggering this vulnerability requires local access.
• There are pre-conditions required for privilege escalation that are difficult to achieve.
• While a system crash is more likely, there is no loss of confidentiality or integrity unless a successful privilege escalation is achieved.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.