CVE-2022-50350 scsi: target: iscsi: Fix a race condition between login_work and the login thread
A race condition in the Linux kernel iSCSI target allows a malicious initiator to cause a kernel crash via a NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50350?
CVE-2022-50350 is a critical vulnerability in Linux kernel, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix a race condition between login_work and the login thread
In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_ready() callback will schedule the login_work and, at the same time, the negotiation may end without clearing the LOGIN_FLAGS_INITIAL_PDU flag (because no additional PDU exchanges are required to complete the login).
The login has been completed but the login_work function will find the LOGIN_FLAGS_INITIAL_PDU flag set and will never stop from rescheduling itself; at this point, if the initiator drops the connection, the iscsit_conn structure will be freed, login_work will dereference a released socket structure and the kernel crashes.
BUG: kernel NULL pointer dereference, address: 0000000000000230 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod] RIP: 0010:_raw_read_lock_bh+0x15/0x30 Call trace: iscsi_target_do_login_rx+0x75/0x3f0 [iscsi_target_mod] process_one_work+0x1e8/0x3c0
Fix this bug by forcing login_work to stop after the login has been completed and the socket callbacks have been restored.
Add a comment to clearify the return values of iscsi_target_do_login()
Weakness: CWE-362
Which versions are affected by CVE-2022-50350?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-50350?
Apply the vendor's patch.
Is CVE-2022-50350 being exploited?
There is no known exploitation of CVE-2022-50350 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-71155, DEBIAN-CVE-2022-50350, GHSA-vh3w-x8qx-rvfm, ROOT-OS-DEBIAN-11-CVE-2022-50350, ROOT-OS-UBUNTU-2204-CVE-2022-50350, UBUNTU-CVE-2022-50350.