CVE-2022-49535

A use-after-free vulnerability was found in the Linux kernel's SCSI lpfc driver, which manages Fibre Channel Host Bus Adapters (HBAs). The issue arises when the driver attempts to handle failed login operations (FLOGI and PLOGI). If a login attempt fails and there is pending device loss event (dev-loss-evt) work, the node structure may be prematurely released. Subsequent operations referencing this released node can lead to a NULL pointer dereference, resulting in a kernel crash.

Red Hat product security has determined a lower CVSS score for this issue for the following reasons:

• There's no evidence of information leakage (confidentiality), and the bug does not tamper with data (integrity).
• Availability is impacted due to potential kernel panic or crash from dereferencing a freed node pointer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.