What’s Vulnerable › Vulnerabilities

CVE-2022-50467: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-01 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to lpfc_nlp_put() with a null pointer to a nodelist structure. Changed lpfc_cmpl_ct_cmd_gft_id() to initialize nodelist pointer upon entry.

Affected products

• Linux kernel: from 5.14 before 5.19.17; from 6.0 before 6.0.3 — fixed in 5.19.17, 6.0.3

How to fix

Upgrade to a fixed version: Linux kernel 5.19.17, 6.0.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/04e7cd8c85636a329d1a6e5a269a7c8b6f71c41c
• https://git.kernel.org/stable/c/59b7e210a522b836a01516c71ee85d1d92c1f075
• https://git.kernel.org/stable/c/82dc1fe4324e2c897f2ed1c66f4fcff03094ac3a

Get alerted when CVE-2022-50467 or the next vulnerability affects your stack