Riskcovery

CVE-2022-49534

scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT

State
Published
Severity
5.5 Medium
Published
Feb 26, 2025
Updated
May 11, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT

There is a potential memory leak in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT (lpfc_rcv_plogi()'s login_mbox).

Check if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(), and then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for service parameters.

For lpfc_els_rsp_reject() failure, free both the ctx_buf for service parameters and the login_mbox.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • 858c9f6c19c6f9bf86cbbc64ce0d17c61d6131b8 to before c00df0f34a6d5e14da379f96ea67e501ce67b002Affected
  • 858c9f6c19c6f9bf86cbbc64ce0d17c61d6131b8 to before 672d1cb40551ea9c95efad43ab6d45e4ab4e015fAffected
LinuxLinux
  • 2.6.23Affected
  • before 2.6.23Not affected
  • 5.18.3 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.