8.8

CVE-2022-49114: scsi: libfc: Fix use after free in fc_exch_abts_resp()

Modified
AliasesUBUNTU-CVE-2022-49114DEBIAN-CVE-2022-49114
Published 26-02-2025Last modified 05-08-2026

Vulnerability summary

CVE-2022-49114 is a high (CVSS 8.8) Use After Free vulnerability in linux. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 8.8, adjacent network); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.36%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 8
RHSA-2023:2458RHSA-2023:2951RHSA-2025:10005RHSA-2025:10009RHSA-2025:10174RHSA-2025:10179

Timeline

  1. 26-02-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release() call to avoid use after free.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.36%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu106 products
  • linuxAll versions (No fix recorded) | < 4.4.0-289.323 | < 4.15.0-189.200 | < 5.4.0-117.132 | < 5.15.0-37.39
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 4.4.0-1160.166 | < 4.4.0-1198.213 | < 4.15.0-1137.148 | < 5.4.0-1078.84 | < 5.15.0-1011.14
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 4a131d4ea8b581ac9b01d3a72754db4848be3232 | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 499d198494e77b6533251b9b909baf5c101129cb | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 6044ad64f41c87382cfeeca281573d1886d80cbe | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836 | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 1d7effe5fff9d28e45e18ac3a564067c7ddfe898 | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < f581df412bc45c95176e3c808ee2839c05b2ab0c | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 87909291762d08fdb60d19069d7a89b5b308d0ef | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 412dd8299b02e4410fe77b8396953c1a8dde183a | ≥ 42e9a92fe6a9095bd68a379aaec7ad2be0337f7a, < 271add11994ba1a334859069367e04d2be2ebdd4 | 2.6.29
  • linux_kernel< 4.9.311 | ≥ 4.10, < 4.14.276 | ≥ 4.15, < 4.19.238 | ≥ 4.20, < 5.4.189 | ≥ 5.5, < 5.10.111 | ≥ 5.11, < 5.15.34 | ≥ 5.16, < 5.16.20 | ≥ 5.17, < 5.17.3
Debian1 product
  • linux< 5.17.3-1

3 vendors · 109 products

References

14 links
Show all 14 references