CVE-2022-50493

A flaw was found in the Linux kernel's qla2xxx driver. When an input/output (I/O) abort request times out, the driver attempts to process completion without verifying whether the request has already finished. A local user could trigger these conditions during system operations such as dynamic processor reconfiguration (CPU hotplugging), leading to a kernel crash and resulting in a Denial of Service (DoS).

A MODERATE severity flaw was found in the Linux kernel qla2xxx SCSI driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9. When an I/O abort request times out, the driver attempts to process command completion without first verifying whether the I/O has already completed. A local user with the ability to trigger these timing-dependent conditions, for example during dynamic CPU reconfiguration (CPU hotplug) on systems using affected QLogic Fibre Channel/NVMe hardware, could cause a kernel crash, resulting in a denial of service. There is no impact to confidentiality or integrity. Fixes for the affected Red Hat Enterprise Linux 7, 8, and 9 streams are currently deferred; the residual risk is limited to a local denial of service that requires specific timing conditions and the affected qla2xxx driver. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those streams. The CVE.org record assigns this flaw an IMPORTANT severity (CVSS 3.1 score of 8.8), which differs from Red Hat's MODERATE rating (CVSS 3.1 score of 4.0) because exploitation requires local access and privileged interaction under specific timing conditions, and the result is limited to a loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.