Null Pointer Dereference in Linux Kernel SCSI Driver

CVE-2022-50467

What is CVE-2022-50467?

A vulnerability was discovered in the Linux Kernel SCSI driver where the lpfc_cmpl_ct_cmd_gft_id() function could cause a null pointer dereference. This issue occurs if the function encounters an error during its execution, resulting in a call to lpfc_nlp_put() with a null pointer to a nodelist structure. To address this, the function has been updated to ensure the nodelist pointer is initialized at the entry, thus enhancing stability and security in the error handling process.

References