Read the docs
TI-2022-24241 Aliases CVE-2022-48715GHSA-6p2j-4rfr-64h6

scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe

Priority LOW 24Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe Running tests with a debug kernel shows that bnx2fc_recv_frame() is modifying the per_cpu lport stats counters in a non-mpsafe way. Just boot a debug kernel and run the bnx2fc driver with the hardware enabled. [ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code: bnx2fc_ [ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] [ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted: G B [ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 [ 1391.699183] Call Trace: [ 1391.699188] dump_stack_lvl+0x57/0x7d [ 1391.699198] check_preemption_disabled+0xc8/0xd0 [ 1391.699205] bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] [ 1391.699215] ? do_raw_spin_trylock+0xb5/0x180 [ 1391.699221] ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc] [ 1391.699229] ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc] [ 1391.699240] bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc] [ 1391.699250] ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc] [ 1391.699258] kthread+0x364/0x420 [ 1391.699263] ? _raw_spin_unlock_irq+0x24/0x50 [ 1391.699268] ? set_kthread_struct+0x100/0x100 [ 1391.699273] ret_from_fork+0x22/0x30 Restore the old get_cpu/put_cpu code with some modifications to reduce the size of the critical section.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Partial Linux (Linux): 4.9.300, 4.14.265, 4.19.228 +5Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux3.16 and later4.9.300, 4.14.265, 4.19.228, 5.4.178, 5.10.99, 5.15.22, 5.16.8, 5.17Patch availableCNA
  • Linux VendorLinux Affected 3.16 and later Fixed in 4.9.300, 4.14.265, 4.19.228, 5.4.178, 5.10.99, 5.15.22, 5.16.8, 5.17 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*3.16.1 to before 4.9.300; 4.10 to before 4.14.265; 4.15 to before 4.19.228; 4.20 to before 5.4.178; 5.5 to before 5.10.99; 5.11 to before 5.15.22; 5.16 to before 5.16.8VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.16:-:*:*:*:*:*:*3.16VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.16:rc4:*:*:*:*:*:*3.16 rc4VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.16:rc5:*:*:*:*:*:*3.16 rc5VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.16:rc6:*:*:*:*:*:*3.16 rc6VulnerableLinux
cpe:2.3:o:linux:linux_kernel:3.16:rc7:*:*:*:*:*:*3.16 rc7VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*5.17 rc1VulnerableLinux
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*5.17 rc2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 3.16.1 to before 4.9.300; 4.10 to before 4.14.265; 4.15 to before 4.19.228; 4.20 to before 5.4.178; 5.5 to before 5.10.99; 5.11 to before 5.15.22; 5.16 to before 5.16.8 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.16:-:*:*:*:*:*:* Versions 3.16 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.16:rc4:*:*:*:*:*:* Versions 3.16 rc4 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.16:rc5:*:*:*:*:*:* Versions 3.16 rc5 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.16:rc6:*:*:*:*:*:* Versions 3.16 rc6 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:3.16:rc7:*:*:*:*:*:* Versions 3.16 rc7 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:* Versions 5.17 rc1 Vulnerable ·Linux
  • cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:* Versions 5.17 rc2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 4.9.300, 4.14.265, 4.19.228, 5.4.178, 5.10.99, 5.15.22, 5.16.8, 5.17

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Not affected: 1 product
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-48715
  2. 2026-10-03 Alias added: GHSA-6p2j-4rfr-64h6

References

Patch 8

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences