CVE-2022-49053

scsi: target: tcmu: Fix possible page UAF

State: Published
Severity: 7.8 High
Published: Feb 26, 2025
Updated: Aug 5, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: tcmu: Fix possible page UAF

tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release().

We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	141685a39151aea95eb56562d2953e919c6c73da to before d7c5d79e50be6e06b669141e3db1f977a0dd4e8eAffected 141685a39151aea95eb56562d2953e919c6c73da to before e3e0e067d5b34e4a68e3cc55f8eebc413f56f8edAffected 141685a39151aea95eb56562d2953e919c6c73da to before fb7a5115422fbd6a4d505e8844f1ef5529f10489Affected 141685a39151aea95eb56562d2953e919c6c73da to before aec36b98a1bbaa84bfd8299a306e4c12314af626Affected 141685a39151aea95eb56562d2953e919c6c73da to before b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322Affected 141685a39151aea95eb56562d2953e919c6c73da to before a9564d84ed9f6ee71017d062d0d2182154294a4bAffected 141685a39151aea95eb56562d2953e919c6c73da to before a6968f7a367f128d120447360734344d5a3d5336Affected
LinuxLinux	4.12Affected before 4.12Not affected 4.14.276 through 4.14.Not affected 4.19.239 through 4.19.Not affected 5.4.190 through 5.4.Not affected 5.10.112 through 5.10.Not affected 5.15.35 through 5.15.Not affected 5.17.4 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

141685a39151aea95eb56562d2953e919c6c73da to before d7c5d79e50be6e06b669141e3db1f977a0dd4e8eAffected
141685a39151aea95eb56562d2953e919c6c73da to before e3e0e067d5b34e4a68e3cc55f8eebc413f56f8edAffected
141685a39151aea95eb56562d2953e919c6c73da to before fb7a5115422fbd6a4d505e8844f1ef5529f10489Affected
141685a39151aea95eb56562d2953e919c6c73da to before aec36b98a1bbaa84bfd8299a306e4c12314af626Affected
141685a39151aea95eb56562d2953e919c6c73da to before b7f3b5d70c834f49f7d87a2f2ed1c6284d9a0322Affected
141685a39151aea95eb56562d2953e919c6c73da to before a9564d84ed9f6ee71017d062d0d2182154294a4bAffected
141685a39151aea95eb56562d2953e919c6c73da to before a6968f7a367f128d120447360734344d5a3d5336Affected

LinuxLinux

4.12Affected
before 4.12Not affected
4.14.276 through 4.14.*Not affected
4.19.239 through 4.19.*Not affected
5.4.190 through 5.4.*Not affected
5.10.112 through 5.10.*Not affected
5.15.35 through 5.15.*Not affected
5.17.4 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.