AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

{"timestamp":"2026-01-14T18:21:59.970337Z","id":"CVE-2022-50350","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/target/iscsi/iscsi_target_nego.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d381a8010a052813a88e20e089be4a58aad8b40a","lessThan":"1533b8b3058db618409f41554ebe768c2e3acfae","versionType":"git","status":"affected"},{"version":"d381a8010a052813a88e20e089be4a58aad8b40a","lessThan":"3ecdca49ca49d4770639d81503c873b6d25887c4","versionType":"git","status":"affected"},{"version":"d381a8010a052813a88e20e089be4a58aad8b40a","lessThan":"fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/target/iscsi/iscsi_target_nego.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","versionType":"semver","status":"unaffected"},{"version":"6.0.16","lessThanOrEqual":"6.0.*","versionType":"semver","status":"unaffected"},{"version":"6.1.2","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362

OR
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1 up to (excluding) 6.1.2
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.12 up to (excluding) 6.0.16

kernel.org: https://git.kernel.org/stable/c/1533b8b3058db618409f41554ebe768c2e3acfae Types: Patch

kernel.org: https://git.kernel.org/stable/c/3ecdca49ca49d4770639d81503c873b6d25887c4 Types: Patch

kernel.org: https://git.kernel.org/stable/c/fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f Types: Patch

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix a race condition between login_work and the login thread

In case a malicious initiator sends some random data immediately after a
login PDU; the iscsi_target_sk_data_ready() callback will schedule the
login_work and, at the same time, the negotiation may end without clearing
the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are
required to complete the login).

The login has been completed but the login_work function will find the
LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling
itself; at this point, if the initiator drops the connection, the
iscsit_conn structure will be freed, login_work will dereference a released
socket structure and the kernel crashes.

BUG: kernel NULL pointer dereference, address: 0000000000000230
PF: supervisor write access in kernel mode
PF: error_code(0x0002) - not-present page
Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod]
RIP: 0010:_raw_read_lock_bh+0x15/0x30
Call trace:
 iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod]
 process_one_work+0x1e8/0x3c0

Fix this bug by forcing login_work to stop after the login has been
completed and the socket callbacks have been restored.

Add a comment to clearify the return values of iscsi_target_do_login()

https://git.kernel.org/stable/c/1533b8b3058db618409f41554ebe768c2e3acfae

https://git.kernel.org/stable/c/3ecdca49ca49d4770639d81503c873b6d25887c4

https://git.kernel.org/stable/c/fec1b2fa62c162d03f5dcd7b03e3c89d3116d49f