CVE-2022-48791: scsi: pm8001: Fix use-after-free for aborted TMF sas_task

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-16 · updated 2026-08-04
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout. When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task(). However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.

Affected products

Linux kernel: before 5.10.102; from 5.11 before 5.15.25; from 5.16 before 5.16.11 — fixed in 5.10.102, 5.15.25, 5.16.11

How to fix

Upgrade to a fixed version: Linux kernel 5.10.102, 5.15.25, 5.16.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-48791 or the next vulnerability affects your stack