CVE-2022-49156: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49156 affects the Linux kernel's qla2xxx SCSI driver. The vulnerability was discovered when the driver made calls into the midlayer (fc_remote_port_delete) which could put the thread to sleep while in interrupt context, leading to a crash. This scheduling-while-atomic bug was fixed in the Linux kernel through a patch that schedules the call in non-interrupt context (Kernel Git).

The vulnerability occurs when the qla2xxx driver attempts to execute fc_remote_port_delete while in interrupt context. This operation can trigger a sleep state, which is not allowed in interrupt context. The issue manifests as a scheduling-while-atomic bug, producing a kernel trace showing the crash path through various kernel functions including schedule_timeout, wait_for_completion, and __wait_rcu_gp (Debian Tracker).

When triggered, this vulnerability causes a kernel crash, disrupting system operations. The crash occurs due to an attempt to schedule while in an atomic context, which violates kernel threading rules (Kernel Git).

The vulnerability is triggered during normal operation of the qla2xxx driver when handling certain SCSI operations. It requires no special privileges to trigger, as it occurs during standard driver operations (Debian Tracker).

The issue has been fixed by modifying the driver to schedule the fc_remote_port_delete call in non-interrupt context using qlt_schedule_sess_for_deletion. This fix has been incorporated into various Linux kernel versions (Kernel Git).