CVE-2022-49120: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49120 is a vulnerability in the Linux kernel affecting the SCSI pm8001 driver. The vulnerability was discovered in February 2022 and involves a task leak in the pm8001sendabortall() function. Specifically, the issue occurs when the allocated SAS task is not properly freed if pm8001tagalloc() or pm8001mpibuildcmd() operations fail (Kernel Git).

The vulnerability exists in the pm8001sendabortall() function of the Linux kernel's SCSI pm8001 driver. The issue stems from a failure to properly free allocated SAS tasks in error conditions, specifically when either pm8001tagalloc() or pm8001mpibuildcmd() operations fail. The fix involves adding proper cleanup code to free the allocated task in these error paths (Kernel Git).

The vulnerability results in a memory leak (task leak) in the Linux kernel's SCSI subsystem when certain error conditions occur in the pm8001 driver (Kernel Git).

The vulnerability has been patched in the Linux kernel. The fix ensures proper cleanup by freeing the allocated SAS task if pm8001tagalloc() or pm8001mpibuild_cmd() fail. Users should update their Linux kernel to a version containing the fix (Kernel Git).