CVE-2022-48695 (GCVE-0-2022-48695)

Vulnerability from cvelistv5 – Published: 2024-05-03 17:44 – Updated: 2026-08-05 08:51
VLAI
Title
scsi: mpt3sas: Fix use-after-free warning
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:39 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < b8fc9e91b931215110ba824d1a2983c5f60b6f82 (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < d4959d09b76eb7a4146f5133962b88d3bddb63d6 (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < 82efb917eeb27454dc4c6fe26432fc8f6c75bc16 (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < 5682c94644fde72f72bded6580c38189ffc856b5 (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < ea10a652ad2ae2cf3eced6f632a5c98f26727057 (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < 6229fa494a5949be209bc73afbc5d0a749c2e3c7 (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < 41acb064c4e013808bc7d5fc1b506fa449425b0b (git)
Affected: 146b16c8071f5f6c67895d15beeee1163f5107c4 , < 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 4.9.328 , ≤ 4.9.* (semver)
Unaffected: 4.14.293 , ≤ 4.14.* (semver)
Unaffected: 4.19.258 , ≤ 4.19.* (semver)
Unaffected: 5.4.213 , ≤ 5.4.* (semver)
Unaffected: 5.10.143 , ≤ 5.10.* (semver)
Unaffected: 5.15.68 , ≤ 5.15.* (semver)
Unaffected: 5.19.9 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48695",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:39:45.670412Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T21:27:24.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.812Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpt3sas/mpt3sas_scsih.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8fc9e91b931215110ba824d1a2983c5f60b6f82",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "d4959d09b76eb7a4146f5133962b88d3bddb63d6",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "82efb917eeb27454dc4c6fe26432fc8f6c75bc16",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "5682c94644fde72f72bded6580c38189ffc856b5",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "ea10a652ad2ae2cf3eced6f632a5c98f26727057",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "6229fa494a5949be209bc73afbc5d0a749c2e3c7",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "41acb064c4e013808bc7d5fc1b506fa449425b0b",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            },
            {
              "lessThan": "991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34",
              "status": "affected",
              "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpt3sas/mpt3sas_scsih.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.328",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.293",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.328",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.293",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.258",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.213",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.143",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.68",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.9",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix use-after-free warning\n\nFix the following use-after-free warning which is observed during\ncontroller reset:\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in the mpt3sas HBA driver\u0027s firmware-event cleanup during local controller reset (MPT3HARDRESET on /dev/mpt3ctl, SCSI EH host reset, or fault-watchdog reset), not in any network-facing packet path.\nAC:L - An attacker who can issue host resets controls both sides of the back-to-back reset sequence that leaves MPT3SAS_REMOVE_UNRESPONDING_DEVICES as current_event while _scsih_fw_event_cleanup_queue runs, so the double fw_event_work_put is reliably triggerable.\nPR:L - The driver does no capable() check on MPT3HARDRESET, and deployments routinely grant /dev/mpt3ctl or HBA /dev/sg* access to non-root storage groups; unprivileged sg I/O with short timeouts can also escalate into scsih_host_reset.\nUI:N - The attacker directly drives resets via ioctl or timed-out SCSI commands; no separate victim action is required.\nS:U - The use-after-free corrupts host-kernel slab state within the same privilege domain; there is no VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - This is a use-after-free of a kmalloc\u0027d fw_event_work (refcount underflow then free), which enables reclaim and disclosure of the object\u0027s contents.\nI:H - UAF of a heap object during reset cleanup enables heap spraying and arbitrary write / control-flow hijacking primitives in kernel context.\nA:H - The refcount underflow triggers a kernel WARNING/oops path and further use of the freed fw_event_work can panic or hang the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:51:48.371Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16"
        },
        {
          "url": "https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057"
        },
        {
          "url": "https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34"
        }
      ],
      "title": "scsi: mpt3sas: Fix use-after-free warning",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48695",
    "datePublished": "2024-05-03T17:44:55.829Z",
    "dateReserved": "2024-05-03T14:55:07.145Z",
    "dateUpdated": "2026-08-05T08:51:48.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48695",
      "date": "2026-09-22",
      "epss": "0.00241",
      "percentile": "0.15523"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/mpt3sas/mpt3sas_scsih.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b8fc9e91b931215110ba824d1a2983c5f60b6f82",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d4959d09b76eb7a4146f5133962b88d3bddb63d6",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "82efb917eeb27454dc4c6fe26432fc8f6c75bc16",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5682c94644fde72f72bded6580c38189ffc856b5",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ea10a652ad2ae2cf3eced6f632a5c98f26727057",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6229fa494a5949be209bc73afbc5d0a749c2e3c7",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "41acb064c4e013808bc7d5fc1b506fa449425b0b",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34",
                    "status": "affected",
                    "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/scsi/mpt3sas/mpt3sas_scsih.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.4"
                  },
                  {
                    "lessThan": "4.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.328",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.293",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.258",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.213",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.68",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82C9EA22-96BE-488C-A979-0A1FBD90A0AE",
                    "versionEndExcluding": "4.9.328",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5D9B742D-912D-4E0C-A42F-367086FDEA88",
                    "versionEndExcluding": "4.14.293",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "253D30F5-3734-4663-883A-288786D3B66E",
                    "versionEndExcluding": "4.19.258",
                    "versionStartIncluding": "4.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4C373116-9E23-44BA-A6B7-87C8BF5C3B85",
                    "versionEndExcluding": "5.4.213",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E77EECF5-C31E-4342-8014-AA844BB83A76",
                    "versionEndExcluding": "5.10.143",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C",
                    "versionEndExcluding": "5.15.168",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4895A99-6E1B-4C76-A510-FDED00AD7D29",
                    "versionEndExcluding": "5.19.9",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "F8446E87-F5F6-41CA-8201-BAE0F0CA6DD9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix use-after-free warning\n\nFix the following use-after-free warning which is observed during\ncontroller reset:\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: mpt3sas: Corrija la advertencia de use-after-free. Corrija la siguiente advertencia de use-after-free que se observa durante el reinicio del controlador: refcount_t: underflow; use-after-free. ADVERTENCIA: CPU: 23 PID: 5399 en lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0"
          }
        ],
        "id": "CVE-2022-48695",
        "lastModified": "2026-08-04T10:17:16.087",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48695",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:39:45.670412Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-03T18:15:08.247",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:48:20+00:00",
      "cve": "CVE-2022-48695",
      "id": "CVE-2022-48695",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "531",
      "product_status:known_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: mpt3sas: Fix use-after-free warning",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48695.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T15:17:55.812Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48695",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-17T17:39:45.670412Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-17T17:39:46.625Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/mpt3sas/mpt3sas_scsih.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "b8fc9e91b931215110ba824d1a2983c5f60b6f82",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "d4959d09b76eb7a4146f5133962b88d3bddb63d6",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "82efb917eeb27454dc4c6fe26432fc8f6c75bc16",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "5682c94644fde72f72bded6580c38189ffc856b5",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "ea10a652ad2ae2cf3eced6f632a5c98f26727057",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "6229fa494a5949be209bc73afbc5d0a749c2e3c7",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "41acb064c4e013808bc7d5fc1b506fa449425b0b",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                },
                {
                  "lessThan": "991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34",
                  "status": "affected",
                  "version": "146b16c8071f5f6c67895d15beeee1163f5107c4",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/scsi/mpt3sas/mpt3sas_scsih.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.4"
                },
                {
                  "lessThan": "4.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.9.*",
                  "status": "unaffected",
                  "version": "4.9.328",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.14.*",
                  "status": "unaffected",
                  "version": "4.14.293",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.258",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.213",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.143",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.68",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.19.*",
                  "status": "unaffected",
                  "version": "5.19.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.0",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.9.328",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.14.293",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.258",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.213",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.143",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.68",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19.9",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0",
                      "versionStartIncluding": "4.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Fix use-after-free warning\n\nFix the following use-after-free warning which is observed during\ncontroller reset:\n\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The UAF is in the mpt3sas HBA driver\u0027s firmware-event cleanup during local controller reset (MPT3HARDRESET on /dev/mpt3ctl, SCSI EH host reset, or fault-watchdog reset), not in any network-facing packet path.\nAC:L - An attacker who can issue host resets controls both sides of the back-to-back reset sequence that leaves MPT3SAS_REMOVE_UNRESPONDING_DEVICES as current_event while _scsih_fw_event_cleanup_queue runs, so the double fw_event_work_put is reliably triggerable.\nPR:L - The driver does no capable() check on MPT3HARDRESET, and deployments routinely grant /dev/mpt3ctl or HBA /dev/sg* access to non-root storage groups; unprivileged sg I/O with short timeouts can also escalate into scsih_host_reset.\nUI:N - The attacker directly drives resets via ioctl or timed-out SCSI commands; no separate victim action is required.\nS:U - The use-after-free corrupts host-kernel slab state within the same privilege domain; there is no VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - This is a use-after-free of a kmalloc\u0027d fw_event_work (refcount underflow then free), which enables reclaim and disclosure of the object\u0027s contents.\nI:H - UAF of a heap object during reset cleanup enables heap spraying and arbitrary write / control-flow hijacking primitives in kernel context.\nA:H - The refcount underflow triggers a kernel WARNING/oops path and further use of the freed fw_event_work can panic or hang the host."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:51:48.371Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/b8fc9e91b931215110ba824d1a2983c5f60b6f82"
            },
            {
              "url": "https://git.kernel.org/stable/c/d4959d09b76eb7a4146f5133962b88d3bddb63d6"
            },
            {
              "url": "https://git.kernel.org/stable/c/82efb917eeb27454dc4c6fe26432fc8f6c75bc16"
            },
            {
              "url": "https://git.kernel.org/stable/c/5682c94644fde72f72bded6580c38189ffc856b5"
            },
            {
              "url": "https://git.kernel.org/stable/c/ea10a652ad2ae2cf3eced6f632a5c98f26727057"
            },
            {
              "url": "https://git.kernel.org/stable/c/6229fa494a5949be209bc73afbc5d0a749c2e3c7"
            },
            {
              "url": "https://git.kernel.org/stable/c/41acb064c4e013808bc7d5fc1b506fa449425b0b"
            },
            {
              "url": "https://git.kernel.org/stable/c/991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34"
            }
          ],
          "title": "scsi: mpt3sas: Fix use-after-free warning",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48695",
        "datePublished": "2024-05-03T17:44:55.829Z",
        "dateReserved": "2024-05-03T14:55:07.145Z",
        "dateUpdated": "2026-08-05T08:51:48.371Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.