# CVE-2022-48666: linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: core: Fix a use-after-free  There are two...

CVE-2022-48666 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48666, released April 28, 2024. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2022-48666
- Priority: Urgent
- CVSS: 9.8 (critical)
- EPSS: 0.0078
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Apr 28, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  scsi: core: Fix a use-after-free  There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed.  This commit fixes the following use-after-free:  ================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace:  <TASK>  dump_stack_lvl+0x34/0x44  print_report.cold+0x5e/0x5db  kasan_report+0xab/0x120  srp_exit_cmd_priv+0x27/0xd0 [ib_srp]  scsi_mq_exit_request+0x4d/0x70  blk_mq_free_rqs+0x143/0x410  __blk_mq_free_map_and_rqs+0x6e/0x100  blk_mq_free_tag_set+0x2b/0x160  scsi_host_dev_release+0xf3/0x1a0  device_release+0x54/0xe0  kobject_put+0xa5/0x120  device_release+0x54/0xe0  kobject_put+0xa5/0x120  scsi_device_dev_release_usercontext+0x4c1/0x4e0  execute_in_process_context+0x23/0x90  device_release+0x54/0xe0  kobject_put+0xa5/0x120  scsi_disk_release+0x3f/0x50  device_release+0x54/0xe0  kobject_put+0xa5/0x120  disk_release+0x17f/0x1b0  device_release+0x54/0xe0  kobject_put+0xa5/0x120  dm_put_table_device+0xa3/0x160 [dm_mod]  dm_put_device+0xd0/0x140 [dm_mod]  free_priority_group+0xd8/0x110 [dm_multipath]  free_multipath+0x94/0xe0 [dm_multipath]  dm_table_destroy+0xa2/0x1e0 [dm_mod]  __dm_destroy+0x196/0x350 [dm_mod]  dev_remove+0x10c/0x160 [dm_mod]  ctl_ioctl+0x2c2/0x590 [dm_mod]  dm_ctl_ioctl+0x5/0x10 [dm_mod]  __x64_sys_ioctl+0xb4/0xf0  dm_ctl_ioctl+0x5/0x10 [dm_mod]  __x64_sys_ioctl+0xb4/0xf0  do_syscall_64+0x3b/0x90  entry_SYSCALL_64_after_hwframe+0x46/0xb0

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 11.6 (bullseye) | 5.10.223-1 | [DSA-5747-1](https://patchblox.com/security/data/fix/linux/dsa-5747-1.md) | Aug 12, 2024 |
| Linux | linux Debian 12.15 (bookworm) | 6.0.2-1 | [DEBIAN-CVE-2022-48666](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48666.md) | Apr 28, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.0.2-1 | [DEBIAN-CVE-2022-48666](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48666.md) | Apr 28, 2024 |
| Linux | linux Debian 14 | 6.0.2-1 | [DEBIAN-CVE-2022-48666](https://patchblox.com/security/data/fix/linux/debian-cve-2022-48666.md) | Apr 28, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.