CVE-2022-50493

A MODERATE severity flaw was found in the Linux kernel qla2xxx SCSI driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, and 9. When an I/O abort request times out, the driver attempts to process command completion without first verifying whether the I/O has already completed. A local user with the ability to trigger these timing-dependent conditions, for example during dynamic CPU reconfiguration (CPU hotplug) on systems using affected QLogic Fibre Channel/NVMe hardware, could cause a kernel crash, resulting in a denial of service. There is no impact to confidentiality or integrity. Fixes for the affected Red Hat Enterprise Linux 7, 8, and 9 streams are currently deferred; the residual risk is limited to a local denial of service that requires specific timing conditions and the affected qla2xxx driver. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those streams. The CVE.org record assigns this flaw an IMPORTANT severity (CVSS 3.1 score of 8.8), which differs from Red Hat's MODERATE rating (CVSS 3.1 score of 4.0) because exploitation requires local access and privileged interaction under specific timing conditions, and the result is limited to a loss of availability.