CVE-2022-50493

scsi: qla2xxx: Fix crash when I/O abort times out

State: Published
Severity: 8.8 High
Published: Oct 4, 2025
Updated: Oct 15, 2026
Reserved: Oct 4, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash when I/O abort times out

While performing CPU hotplug, a crash with the following stack was seen:

Call Trace: qla24xx_process_response_queue+0x42a/0x970 [qla2xxx] qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx] qla_nvme_post_cmd+0x166/0x240 [qla2xxx] nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc] blk_mq_dispatch_rq_list+0x17b/0x610 __blk_mq_sched_dispatch_requests+0xb0/0x140 blk_mq_sched_dispatch_requests+0x30/0x60 __blk_mq_run_hw_queue+0x35/0x90 __blk_mq_delay_run_hw_queue+0x161/0x180 blk_execute_rq+0xbe/0x160 __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core] nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics] nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc] nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc] process_one_work+0x1e8/0x3c0

On abort timeout, completion was called without checking if the I/O was already completed.

Verify that I/O and abort request are indeed outstanding before attempting completion.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before 5f730e489e741c28fe6a5b3308e33c094462acb0Affected 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before d3871af13aa03fbbe7fbb812eaf140501229a72eAffected 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before cb4dff498468b62e8c520568559b3a9007e104d7Affected 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before 05382ed9142cf8a8a3fb662224477eecc415778bAffected 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before 68ad83188d782b2ecef2e41ac245d27e0710fe8eAffected 457173c8b43ecd3ac48c8ace8d4437a50f7ad77bAffected b7abcc7df5e131c0b4bf89cb2411c5301ee83d26Affected 5.3.17 to before 5.4Affected 5.4.4 to before 5.5Affected
LinuxLinux	5.5Affected before 5.5Not affected 5.10.258 through 5.10.Not affected 5.15.86 through 5.15.Not affected 6.0.16 through 6.0.Not affected 6.1.2 through 6.1.Not affected 6.2 and laterNot affected

Product

Versions

LinuxLinux

71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before 5f730e489e741c28fe6a5b3308e33c094462acb0Affected
71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before d3871af13aa03fbbe7fbb812eaf140501229a72eAffected
71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before cb4dff498468b62e8c520568559b3a9007e104d7Affected
71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before 05382ed9142cf8a8a3fb662224477eecc415778bAffected
71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 to before 68ad83188d782b2ecef2e41ac245d27e0710fe8eAffected
457173c8b43ecd3ac48c8ace8d4437a50f7ad77bAffected
b7abcc7df5e131c0b4bf89cb2411c5301ee83d26Affected
5.3.17 to before 5.4Affected
5.4.4 to before 5.5Affected

LinuxLinux

5.5Affected
before 5.5Not affected
5.10.258 through 5.10.*Not affected
5.15.86 through 5.15.*Not affected
6.0.16 through 6.0.*Not affected
6.1.2 through 6.1.*Not affected
6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.