CVE-2022-49120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49120 is a vulnerability in the Linux kernel affecting the SCSI pm8001 driver. The vulnerability was discovered in February 2022 and involves a task leak in the pm8001_send_abort_all() function. Specifically, the issue occurs when the allocated SAS task is not properly freed if pm8001_tag_alloc() or pm8001_mpi_build_cmd() operations fail (Kernel Git).

The vulnerability exists in the pm8001_send_abort_all() function of the Linux kernel's SCSI pm8001 driver. The issue stems from a failure to properly free allocated SAS tasks in error conditions, specifically when either pm8001_tag_alloc() or pm8001_mpi_build_cmd() operations fail. The fix involves adding proper cleanup code to free the allocated task in these error paths (Kernel Git).

The vulnerability results in a memory leak (task leak) in the Linux kernel's SCSI subsystem when certain error conditions occur in the pm8001 driver (Kernel Git).

The vulnerability has been patched in the Linux kernel. The fix ensures proper cleanup by freeing the allocated SAS task if pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail. Users should update their Linux kernel to a version containing the fix (Kernel Git).