{
  "cveId": "CVE-2022-49082",
  "url": "https://patchblox.com/security/cve/CVE-2022-49082",
  "summary": "CVE-2022-49082 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49082, released February 26, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  scsi: mpt3sas: Fix use after free in _scsih_expa...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()  The function mpt3sas_transport_port_remove() called in _scsih_expander_node_remove() frees the port field of the sas_expander structure, leading to the following use-after-free splat from KASAN when the ioc_info() call following that function is executed (e.g. when doing rmmod of the driver module):  [ 3479.371167] ================================================================== [ 3479.378496] BUG: KASAN: use-after-free in _scsih_expander_node_remove\u002B0x710/0x750 [mpt3sas] [ 3479.386936] Read of size 1 at addr ffff8881c037691c by task rmmod/1531 [ 3479.393524] [ 3479.395035] CPU: 18 PID: 1531 Comm: rmmod Not tainted 5.17.0-rc8\u002B #1436 [ 3479.401712] Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.1 06/02/2021 [ 3479.409263] Call Trace: [ 3479.411743]  \u003CTASK\u003E [ 3479.413875]  dump_stack_lvl\u002B0x45/0x59 [ 3479.417582]  print_address_description.constprop.0\u002B0x1f/0x120 [ 3479.423389]  ? _scsih_expander_node_remove\u002B0x710/0x750 [mpt3sas] [ 3479.429469]  kasan_report.cold\u002B0x83/0xdf [ 3479.433438]  ? _scsih_expander_node_remove\u002B0x710/0x750 [mpt3sas] [ 3479.439514]  _scsih_expander_node_remove\u002B0x710/0x750 [mpt3sas] [ 3479.445411]  ? _raw_spin_unlock_irqrestore\u002B0x2d/0x40 [ 3479.452032]  scsih_remove\u002B0x525/0xc90 [mpt3sas] [ 3479.458212]  ? mpt3sas_expander_remove\u002B0x1d0/0x1d0 [mpt3sas] [ 3479.465529]  ? down_write\u002B0xde/0x150 [ 3479.470746]  ? up_write\u002B0x14d/0x460 [ 3479.475840]  ? kernfs_find_ns\u002B0x137/0x310 [ 3479.481438]  pci_device_remove\u002B0x65/0x110 [ 3479.487013]  __device_release_driver\u002B0x316/0x680 [ 3479.493180]  driver_detach\u002B0x1ec/0x2d0 [ 3479.498499]  bus_remove_driver\u002B0xe7/0x2d0 [ 3479.504081]  pci_unregister_driver\u002B0x26/0x250 [ 3479.510033]  _mpt3sas_exit\u002B0x2b/0x6cf [mpt3sas] [ 3479.516144]  __x64_sys_delete_module\u002B0x2fd/0x510 [ 3479.522315]  ? free_module\u002B0xaa0/0xaa0 [ 3479.527593]  ? __cond_resched\u002B0x1c/0x90 [ 3479.532951]  ? lockdep_hardirqs_on_prepare\u002B0x273/0x3e0 [ 3479.539607]  ? syscall_enter_from_user_mode\u002B0x21/0x70 [ 3479.546161]  ? trace_hardirqs_on\u002B0x1c/0x110 [ 3479.551828]  do_syscall_64\u002B0x35/0x80 [ 3479.556884]  entry_SYSCALL_64_after_hwframe\u002B0x44/0xae [ 3479.563402] RIP: 0033:0x7f1fc482483b ... [ 3479.943087] ==================================================================  Fix this by introducing the local variable port_id to store the port ID value before executing mpt3sas_transport_port_remove(). This local variable is then used in the call to ioc_info() instead of dereferencing the freed port structure.",
  "published": "2025-02-26T07:00:45Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00252,
  "epssPercentile": 0.16797,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2022-49082",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49082",
      "released": "2025-02-26T07:00:45Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2022-49082",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49082",
      "released": "2025-02-26T07:00:45Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.17.3-1",
      "fix": "DEBIAN-CVE-2022-49082",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49082",
      "released": "2025-02-26T07:00:45Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}