Junglewise Threat Intelligence

CVE-2022-50459: Linux kernel iSCSI TCP null pointer dereference in getpeername

CVE-2022-50459 · Severity: high · CVSS 7.8 · Published 2025-10-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's iSCSI over TCP driver has a race condition where accessing socket information via sysfs can crash the system if the socket is being released at the same time. This affects systems using iSCSI storage protocol and can cause service interruption or a kernel panic.

Technical details

This is a null pointer dereference vulnerability in the iscsi_tcp driver (drivers/scsi/iscsi_tcp.c) caused by a race condition between socket parameter access and socket release. The vulnerability occurs when iscsi_sw_tcp_conn_get_param() or iscsi_sw_tcp_host_get_param() call kernel_getpeername() while simultaneously iscsi_sw_tcp_release_conn() is releasing the socket, leading to a dereference of a NULL sock->ops pointer. The root cause is improper reference counting: the code held a reference to "struct sock" but needed one on "struct socket". The fix replaces spinlock-based synchronization with a dedicated mutex (sock_lock) to serialize access to the socket between interface code paths and the release path.

Affected products

  • Linux Linux kernel prior to commit 57569c37f0add1b6489e1a1563c71519daf732cf

Timeline

  • 2022-09-07: disclosed
  • 2022-09-25: patched: Upstream fix merged by Martin K. Petersen
  • 2022-10-21: other: Backported to stable kernels

References

Related threats