In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix use after free in fc_exch_abts_resp()

fc_exch_release(ep) will decrease the ep's reference count. When the
reference count reaches zero, it is freed. But ep is still used in the
following code, which will lead to a use after free.

Return after the fc_exch_release() call to avoid use after free.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00065.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 4a131d4ea8b581ac9b01d3a72754db4848be3232
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 499d198494e77b6533251b9b909baf5c101129cb
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 6044ad64f41c87382cfeeca281573d1886d80cbe
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 1d7effe5fff9d28e45e18ac3a564067c7ddfe898
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < f581df412bc45c95176e3c808ee2839c05b2ab0c
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 87909291762d08fdb60d19069d7a89b5b308d0ef
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 412dd8299b02e4410fe77b8396953c1a8dde183a
42e9a92fe6a9095bd68a379aaec7ad2be0337f7a affected < 271add11994ba1a334859069367e04d2be2ebdd4
Linux Linux affected
Version Status Constraints
2.6.29 affected —
0 unaffected < 2.6.29
4.9.311 unaffected ≤ 4.9.*
4.14.276 unaffected ≤ 4.14.*
4.19.238 unaffected ≤ 4.19.*
5.4.189 unaffected ≤ 5.4.*
5.10.111 unaffected ≤ 5.10.*
5.15.34 unaffected ≤ 5.15.*
5.16.20 unaffected ≤ 5.16.*
5.17.3 unaffected ≤ 5.17.*
5.18 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-0:4.18.0-477.10.1.el8_8 cpe:/o:redhat:enterprise_linux:8 RHSA-2023:2951 2023-05-16T00:00:00Z
Red Hat Enterprise Linux 8.2 Advanced Update Support
kernel-0:4.18.0-193.156.1.el8_2 cpe:/o:redhat:rhel_aus:8.2 RHSA-2025:10179 2025-07-02T00:00:00Z
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
kernel-0:4.18.0-305.161.1.el8_4 cpe:/o:redhat:rhel_aus:8.4 RHSA-2025:10005 2025-07-01T00:00:00Z
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
kernel-0:4.18.0-372.150.1.el8_6 cpe:/o:redhat:rhel_aus:8.6 RHSA-2025:10009 2025-07-01T00:00:00Z
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
kernel-0:4.18.0-372.150.1.el8_6 cpe:/o:redhat:rhel_tus:8.6 RHSA-2025:10009 2025-07-01T00:00:00Z
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
kernel-0:4.18.0-372.150.1.el8_6 cpe:/o:redhat:rhel_e4s:8.6 RHSA-2025:10009 2025-07-01T00:00:00Z
Red Hat Enterprise Linux 9
kernel-0:5.14.0-284.11.1.el9_2 cpe:/a:redhat:enterprise_linux:9 RHSA-2023:2458 2023-05-09T00:00:00Z
kernel-0:5.14.0-284.11.1.el9_2 cpe:/o:redhat:enterprise_linux:9 RHSA-2023:2458 2023-05-09T00:00:00Z
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
kernel-0:5.14.0-70.136.1.el9_0 cpe:/a:redhat:rhel_e4s:9.0 RHSA-2025:10174 2025-07-01T00:00:00Z
kernel-rt-0:5.14.0-70.136.1.rt21.208.el9_0 cpe:/a:redhat:rhel_e4s:9.0::nfv RHSA-2025:10193 2025-07-02T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Redhat Subscribe
Enterprise Linux Subscribe
Rhel Aus Subscribe
Rhel E4s Subscribe
Rhel Tus Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2022-55099 In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1d7effe5fff9d28e45e18ac3a564067c7ddfe898 cve-icon cve-icon
https://git.kernel.org/stable/c/271add11994ba1a334859069367e04d2be2ebdd4 cve-icon cve-icon
https://git.kernel.org/stable/c/412dd8299b02e4410fe77b8396953c1a8dde183a cve-icon cve-icon
https://git.kernel.org/stable/c/499d198494e77b6533251b9b909baf5c101129cb cve-icon cve-icon
https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232 cve-icon cve-icon
https://git.kernel.org/stable/c/5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836 cve-icon cve-icon
https://git.kernel.org/stable/c/6044ad64f41c87382cfeeca281573d1886d80cbe cve-icon cve-icon
https://git.kernel.org/stable/c/87909291762d08fdb60d19069d7a89b5b308d0ef cve-icon cve-icon
https://git.kernel.org/stable/c/f581df412bc45c95176e3c808ee2839c05b2ab0c cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025022602-CVE-2022-49114-86bb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-49114 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-49114 cve-icon
History

Wed, 02 Jul 2025 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_e4s:9.0::nfv
cpe:/o:redhat:rhel_aus:8.2

Tue, 01 Jul 2025 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/o:redhat:rhel_aus:8.4
cpe:/o:redhat:rhel_aus:8.6
cpe:/o:redhat:rhel_e4s:8.6
cpe:/o:redhat:rhel_tus:8.6
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Tus

Tue, 13 May 2025 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux

Tue, 25 Mar 2025 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Tue, 04 Mar 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 27 Feb 2025 01:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 26 Feb 2025 02:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free.
Title scsi: libfc: Fix use after free in fc_exch_abts_resp()
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-21T08:44:06.430Z

Reserved: 2025-02-26T01:49:39.262Z

Link: CVE-2022-49114

cve-icon Vulnrichment

Updated: 2025-03-04T18:03:28.399Z

cve-icon NVD

Status : Analyzed

Published: 2025-02-26T07:00:48.773

Modified: 2025-03-25T16:19:46.613

Link: CVE-2022-49114

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-26T00:00:00Z

Links: CVE-2022-49114 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses