CVE-2022-48666
A use-after-free vulnerability was discovered in the Linux kernel's SCSI subsystem. This flaw occurs when the system attempts to access memory that has already been released, specifically during the cleanup of SCSI host resources.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running Linux kernel version 6.0 or affected versions of the Linux kernel.
Real-world impact
An attacker could potentially exploit this flaw to cause a system crash or execute arbitrary code with high privileges, leading to a total loss of confidentiality, integrity, and availability.
Why this severity
This vulnerability is rated critical because it is easily exploitable over a network without requiring user interaction or special privileges, and it can lead to a complete compromise of the system.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for the scsi: core use-after-free vulnerability.
NVD-referenced vendor advisory
Timeline
- Apr 28, 2024 · Apr 28, 2024PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 5, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.