CVE-2022-49156

scsi: qla2xxx: Fix scheduling while atomic

MEDIUM
5.5
CVSS Score
Published: February 26, 2025 at 01:55 AM UTC
Updated: June 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix scheduling while atomic The driver makes a call into midlayer (fc_remote_port_delete) which can put the thread to sleep. The thread that originates the call is in interrupt context. The combination of the two trigger a crash. Schedule the call in non-interrupt context where it is more safe. kernel: BUG: scheduling while atomic: swapper/7/0/0x00010000 kernel: Call Trace: kernel: <IRQ> kernel: dump_stack+0x66/0x81 kernel: __schedule_bug.cold.90+0x5/0x1d kernel: __schedule+0x7af/0x960 kernel: schedule+0x28/0x80 kernel: schedule_timeout+0x26d/0x3b0 kernel: wait_for_completion+0xb4/0x140 kernel: ? wake_up_q+0x70/0x70 kernel: __wait_rcu_gp+0x12c/0x160 kernel: ? sdev_evt_alloc+0xc0/0x180 [scsi_mod] kernel: synchronize_sched+0x6c/0x80 kernel: ? call_rcu_bh+0x20/0x20 kernel: ? __bpf_trace_rcu_invoke_callback+0x10/0x10 kernel: sdev_evt_alloc+0xfd/0x180 [scsi_mod] kernel: starget_for_each_device+0x85/0xb0 [scsi_mod] kernel: ? scsi_init_io+0x360/0x3d0 [scsi_mod] kernel: scsi_init_io+0x388/0x3d0 [scsi_mod] kernel: device_for_each_child+0x54/0x90 kernel: fc_remote_port_delete+0x70/0xe0 [scsi_transport_fc] kernel: qla2x00_schedule_rport_del+0x62/0xf0 [qla2xxx] kernel: qla2x00_mark_device_lost+0x9c/0xd0 [qla2xxx] kernel: qla24xx_handle_plogi_done_event+0x55f/0x570 [qla2xxx] kernel: qla2x00_async_login_sp_done+0xd2/0x100 [qla2xxx] kernel: qla24xx_logio_entry+0x13a/0x3c0 [qla2xxx] kernel: qla24xx_process_response_queue+0x306/0x400 [qla2xxx] kernel: qla24xx_msix_rsp_q+0x3f/0xb0 [qla2xxx] kernel: __handle_irq_event_percpu+0x40/0x180 kernel: handle_irq_event_percpu+0x30/0x80 kernel: handle_irq_event+0x36/0x60

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

v < 5.10.1104.11 ≤ v < 5.10.1104.11 ≤ v < 5.15.334.11 ≤ v < 5.16.194.11 ≤ v < 5.17.24.11 ≤ v < 5.185.11 ≤ v < 5.15.335.16 ≤ v < 5.16.195.17 ≤ v < 5.17.24.11726b85487067d7f5b23495bc33c484b8517c4074
Vendor states this is fixed in 78225d6a2a4ffdb2250ce2b7691a9e68a3f86912 (fixed)
Vendor states this is fixed in 78612f2fe8e26637476d756a44f0f05cca0d97de (fixed)
Vendor states this is fixed in 7fef50214dd04427233a2e66cd624d468e67aecb (fixed)
Vendor states this is fixed in 826a9d4a00d1424afa961504aec6298ee92d5053 (fixed)
Vendor states this is fixed in afd438ff874ca40b74321b3fa19bd61adfd7ca0c (fixed)
Vendor states this is fixed in 4.11 (unaffected)
Vendor states this is fixed in 5.10.110 (unaffected)
Vendor states this is fixed in 5.15.33 (unaffected)
Vendor states this is fixed in 5.16.19 (unaffected)
Vendor states this is fixed in 5.17.2 (unaffected)
Vendor states this is fixed in 5.18 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/78225d6a2a4ffdb2250ce2b7691a9e68a3f86912
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/78612f2fe8e26637476d756a44f0f05cca0d97de
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7fef50214dd04427233a2e66cd624d468e67aecb
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/826a9d4a00d1424afa961504aec6298ee92d5053
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/afd438ff874ca40b74321b3fa19bd61adfd7ca0c

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card