CVE-2022-50098

A flaw was found in the Linux kernel's qla2xxx driver. During storage input/output (I/O) timeout error handling, the driver fails to properly manage SCSI Request Block (SRB) structures, resulting in access to stale memory. A local user can exploit this condition during storage timeouts to trigger a kernel crash, leading to a Denial of Service (DoS).

This vulnerability is rated as Moderate severity rather than Important because exploitation requires local access, specific QLogic Fibre Channel storage hardware, and the occurrence of I/O timeout race conditions, resulting solely in a denial of service without compromising confidentiality or integrity. Systems without QLogic host bus adapters or environments that do not load the qla2xxx driver are unaffected by this issue. In typical enterprise deployments, triggering this fault requires an unprivileged local user to manipulate storage requests while the underlying SAN or Fibre Channel interface experiences severe I/O degradation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.