CVE-2022-49535

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling.

• CWE-416

• https://git.kernel.org/stable/c/10663ebec0ad5c78493a0dd34c9ee4d73d7ca0dfPatch
• https://git.kernel.org/stable/c/577a942df3de2666f6947bdd3a5c9e8d30073424Patch
• https://git.kernel.org/stable/c/c7dc74ab7975c9b96284abfe4cca756d75fa4604Patch

Published

Feb 26, 2025

Last Modified

Aug 4, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-4953The Elementor Website Builder WordPress plugin before 3.5.5 …6.1
• CVE-2022-49530In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2022-49531In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49532In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49533In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49534In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49536In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49537In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49538In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-49539In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2022-4954The Waiting: One-click countdowns plugin for WordPress is vu…4.8
• CVE-2022-49540In the Linux kernel, the following vulnerability has been re…4.7