CVE-2022-49521

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49521
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() If no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a received frame, the frame is dropped and resources are leaked. Fix by returning resources when discarding an unhandled frame type. Update lpfc_fc_frame_check() handling of NOP basic link service.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/08709769ff2fb6c5ffedcda3742700d8ea1618a8 Patch
https://git.kernel.org/stable/c/40cf4ea4d2d497f7732c87d350ba5c3f5e8a43a1 Patch
https://git.kernel.org/stable/c/646db1a560f44236b7278b822ca99a1d3b6ea72c Patch
https://git.kernel.org/stable/c/7860d8f8082605b57596aa82d3d438c1fdad9a9e Patch
https://git.kernel.org/stable/c/fa1b509d41c5433672f72c0615cf4aefa0611c99 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Oct 2025, 12:07

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE CWE-401
References () https://git.kernel.org/stable/c/08709769ff2fb6c5ffedcda3742700d8ea1618a8 - () https://git.kernel.org/stable/c/08709769ff2fb6c5ffedcda3742700d8ea1618a8 - Patch
References () https://git.kernel.org/stable/c/40cf4ea4d2d497f7732c87d350ba5c3f5e8a43a1 - () https://git.kernel.org/stable/c/40cf4ea4d2d497f7732c87d350ba5c3f5e8a43a1 - Patch
References () https://git.kernel.org/stable/c/646db1a560f44236b7278b822ca99a1d3b6ea72c - () https://git.kernel.org/stable/c/646db1a560f44236b7278b822ca99a1d3b6ea72c - Patch
References () https://git.kernel.org/stable/c/7860d8f8082605b57596aa82d3d438c1fdad9a9e - () https://git.kernel.org/stable/c/7860d8f8082605b57596aa82d3d438c1fdad9a9e - Patch
References () https://git.kernel.org/stable/c/fa1b509d41c5433672f72c0615cf4aefa0611c99 - () https://git.kernel.org/stable/c/fa1b509d41c5433672f72c0615cf4aefa0611c99 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Se corrige la pérdida de recursos en lpfc_sli4_send_seq_to_ulp() Si no se encuentra ningún controlador en lpfc_complete_unsol_iocb() que coincida con el rctl de una trama recibida, la trama se descarta y se pierden recursos. Se soluciona devolviendo recursos al descartar un tipo de trama no controlada. Se actualiza la gestión de lpfc_fc_frame_check() del servicio de enlace básico NOP.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-10-21 12:07

NVD link : CVE-2022-49521

Mitre link : CVE-2022-49521

CVE.ORG link : CVE-2022-49521

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime