scsi: qedf: Fix refcount issue when LOGO is received during TMF (CVE-2022-48823) | HOL Guard CVE

Medium · CVSS 5.5CVE-2022-48823

scsi: qedf: Fix refcount issue when LOGO is received during TMF

Answer in brief

CVE-2022-48823 records a Medium severity (CVSS 5.5) vulnerability in scsi: qedf: Fix refcount issue when LOGO is received during TMF. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 16, 2024Updated Aug 13, 2026Source checked Sep 27, 2026First seen by HOL Aug 13, 2026Material review Aug 13, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 5.5
Exploitation: Not marked as known exploited
Affected software: 4 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Affected products and reported versions
Product	Affected versions	Fixed versions
cpe:2.3:o:linux:linux_kernel::::::::	Not reported	Not reported
cpe:2.3:o:linux:linux_kernel:5.17:rc1::::::	Not reported	Not reported

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=69ef2c692510d5154c613569caeeed3c74806231 <7cc32ff0cd6c44a3c26de5faecfe8b5546198fad \|\| >=69ef2c692510d5154c613569caeeed3c74806231 <87f187e5265bc8e3b38faef8b9db864cdd61dde7 \|\| >=69ef2c692510d5154c613569caeeed3c74806231 <6be8eaad75ca73131e2a697f0270dc8ee73814a8 \|\| >=69ef2c692510d5154c613569caeeed3c74806231 <7fcbed38503bb34c6e6538b6a9482d1c6bead1e8 \|\| >=69ef2c692510d5154c613569caeeed3c74806231 <5239ab63f17cee643bd4bf6addfedebaa7d4f41e	7cc32ff0cd6c44a3c26de5faecfe8b5546198fad, 87f187e5265bc8e3b38faef8b9db864cdd61dde7, 6be8eaad75ca73131e2a697f0270dc8ee73814a8, 7fcbed38503bb34c6e6538b6a9482d1c6bead1e8, 5239ab63f17cee643bd4bf6addfedebaa7d4f41e
Linux/Linuxgeneric	5.2	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 7cc32ff0cd6c44a3c26de5faecfe8b5546198fad if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 16, 2024
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 13, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 13, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix refcount issue when LOGO is received during TMF Hung task call trace was seen during LOGO processing. [ 974.309060] [0000:00:00.0]:[qedf_eh_device_reset:868]: 1:0:2:0: LUN RESET Issued... [ 974.309065] [0000:00:00.0]:[qedf_initiate_tmf:2422]: tm_flags 0x10 sc_cmd 00000000c16b930f op = 0x2a target_id = 0x2 lun=0 [ 974.309178] [0000:00:00.0]:[qedf_initiate_tmf:2431]: portid=016900 tm_flags =LUN RESET [ 974.309222] [0000:00:00.0]:[qedf_initiate_tmf:2438]: orig io_req = 00000000ec78df8f xid = 0x180 ref_cnt = 1. [ 974.309625] host1: rport 016900: Received LOGO request while in state Ready [ 974.309627] host1: rport 016900: Delete port [ 974.309642] host1: rport 016900: work event 3 [ 974.309644] host1: rport 016900: lld callback ev 3 [ 974.313243] [0000:61:00.2]:[qedf_execute_tmf:2383]:1: fcport is uploading, not executing flush. [ 974.313295] [0000:61:00.2]:[qedf_execute_tmf:2400]:1: task mgmt command success... [ 984.031088] INFO: task jbd2/dm-15-8:7645 blocked for more than 120 seconds. [ 984.031136] Not tainted 4.18.0-305.el8.x86_64 #1 [ 984.031166] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 984.031209] jbd2/dm-15-8 D 0 7645 2 0x80004080 [ 984.031212] Call Trace: [ 984.031222] __schedule+0x2c4/0x700 [ 984.031230] ? unfreeze_partials.isra.83+0x16e/0x1a0 [ 984.031233] ? bit_wait_timeout+0x90/0x90 [ 984.031235] schedule+0x38/0xa0 [ 984.031238] io_schedule+0x12/0x40 [ 984.031240] bit_wait_io+0xd/0x50 [ 984.031243] __wait_on_bit+0x6c/0x80 [ 984.031248] ? free_buffer_head+0x21/0x50 [ 984.031251] out_of_line_wait_on_bit+0x91/0xb0 [ 984.031257] ? init_wait_var_entry+0x50/0x50 [ 984.031268] jbd2_journal_commit_transaction+0x112e/0x19f0 [jbd2] [ 984.031280] kjournald2+0xbd/0x270 [jbd2] [ 984.031284] ? finish_wait+0x80/0x80 [ 984.031291] ? commit_timeout+0x10/0x10 [jbd2] [ 984.031294] kthread+0x116/0x130 [ 984.031300] ? kthread_flush_work_fn+0x10/0x10 [ 984.031305] ret_from_fork+0x1f/0x40 There was a ref count issue when LOGO is received during TMF. This leads to one of the I/Os hanging with the driver. Fix the ref count.

Quoted source text, attributed separately from HOL analysis.