7.8

CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash

Modified
AliasesUBUNTU-CVE-2022-21546DEBIAN-CVE-2022-21546
Published 02-05-2025Last modified 05-08-2026

Vulnerability summary

CVE-2022-21546 is a high (CVSS 7.8) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.45%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 11
DLA-4327-1SUSE-SU-2025:02334-1USN-7654-1USN-7654-2USN-7654-3USN-7654-4

Timeline

  1. 02-05-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indicates there is no data buffer that gets written out. If this bit is set using commands like "sg_write_same --ndob" we will crash in target_core_iblock/file's execute_write_same handlers when we go to access the se_cmd->t_data_sg because its NULL. This patch adds a check for the NDOB bit in the common WRITE SAME code because we don't support it. And, it adds a check for zero SG elements in each handler in case the initiator tries to send a normal WRITE SAME with no data buffer.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu116 products
  • linuxAll versions (No fix recorded) | < 5.15.0-144.157
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1088.95
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
Linux2 products
  • linux≥ f6970ad31d42fceb38b5595cbad093a4d0bfcc43, < 54e57be2573cf0b8bf650375fd8752987b6c3d3b | ≥ f6970ad31d42fceb38b5595cbad093a4d0bfcc43, < d8e6a27e9238dd294d6f2f401655f300dca20899 | ≥ f6970ad31d42fceb38b5595cbad093a4d0bfcc43, < 4226622647e3e5ac06d3ebc1605b917446157510 | ≥ f6970ad31d42fceb38b5595cbad093a4d0bfcc43, < ccd3f449052449a917a3e577d8ba0368f43b8f29 | 3.8
  • linux_kernel< 5.4.294 | ≥ 5.5, < 5.10.238 | ≥ 5.11, < 5.15.182 | ≥ 5.16, < 5.19 | 5.19:rc1 | 5.19:rc2 | 5.19:rc3 | 5.19:rc4 | 5.19:rc5 | 5.19:rc6

3 vendors · 120 products

References

21 links
Show all 21 references