LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49504: scsi: lpfc: Inhibit aborts if external loopback plug is inserted

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is directly connected to a target device, the system oops in the llpfc_set_rrq_active() routine. When the loopback was inserted an FLOGI was transmit. As we're looped back, we receive the FLOGI request. The FLOGI is ABTS'd as we recognize the same wppn thus understand it's a loopback. However, as the ABTS sends address information the port is not set to (fffffe), the ABTS is dropped on the wire. A short 1 frame loopback test is run and completes before the ABTS times out. The looback is unplugged and the new cable plugged in, and the an FLOGI to the new device occurs and completes. Due to a mixup in ref counting the completion of the new FLOGI releases the fabric ndlp. Then the original ABTS completes and references the released ndlp generating the oops. Correct by no-op'ing the ABTS when in loopback mode (it will be dropped anyway). Added a flag to track the mode to recognize when it should be no-op'd.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash issue in the lpfc storage driver. It can occur after an external loopback test when the loopback plug is replaced with a normal cable connected to a target device. The cited sources do not show remote exploitation, active exploitation, or business-wide impact beyond affected Linux storage hosts.

Executive priority

Treat this as targeted operational risk for Linux storage infrastructure, not an emergency internet-wide vulnerability. Prioritize affected storage hosts, especially production systems where a kernel oops could disrupt availability.

Technical view

The lpfc driver can dereference a released fabric node after loopback-mode FLOGI and ABTS handling races with a later normal FLOGI. The kernel fix no-ops ABTS in loopback mode and tracks that state with a flag. The observed failure is an oops in the RRQ active path.

Likely exposure

Exposure appears limited to Linux systems using the lpfc SCSI Fibre Channel driver and workflows involving external loopback testing followed by normal cabling. The source bundle lists Linux as affected and names versions, but does not provide a clean deployable version matrix.

Exploitation context

No source in the bundle reports active exploitation, public exploit code, or CISA KEV listing. The described trigger requires a specific storage-driver hardware state and cable/test sequence, so it reads as operational reliability risk rather than broad internet-facing exposure.

Researcher notes

Evidence is limited to the CVE description and two stable kernel commits. There is no CVSS, CWE, exploit status, or complete affected-version guidance in the provided bundle. Analysis should stay tied to lpfc loopback-mode ABTS/FLOGI handling and the cited fix behavior.

Mitigation direction

  • Review vendor kernel advisories for fixed packages containing the cited lpfc commits.
  • Prioritize updates on Linux hosts using lpfc Fibre Channel adapters.
  • Avoid external loopback testing on production storage hosts until patched or vendor-guided.
  • Schedule maintenance because kernel updates usually require reboot or host failover.

Validation and detection

  • Inventory Linux hosts using the lpfc driver or Fibre Channel HBAs.
  • Compare running kernel packages against vendor advisories for CVE-2022-49504.
  • Check whether external loopback tests are part of operational procedures.
  • Review kernel logs for lpfc-related oops events after loopback testing.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49504 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1b51197d0fd0c06877c6df1bba84ac4008a7fc60, 1b51197d0fd0c06877c6df1bba84ac4008a7fc60unaffected
LinuxLinux3.3, 0, 5.18.3, 5.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.