CVE-2022-49535

Summary

CVE-2022-49535 is a vulnerability affecting the Linux kernel that has been addressed. In the lpfc driver, a null pointer dereference can occur when the node is released prematurely. This happens if lpfc_issue_els_flogi() fails and there is pending dev-loss-evt work, causing the released node to be referenced again and resulting in a use-after-free condition. A similar issue is found in lpfc_cmpl_els_plogi() when processing non-zero ELS PLOGI completion status and dev-loss-evt work is pending. To mitigate these issues, a test for pending dev-loss events has been added before decrementing the node reference count during FLOGI, PLOGI, PRLI, and ADISC handling.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.