CVE-2022-49534: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49534 is a vulnerability in the Linux kernel affecting the SCSI lpfc driver. The issue was discovered in the lpfcignoreelscmpl() and lpfcelsrspreject() functions where a potential memory leak could occur when handling NPIV PLOGI_RJT operations (Kernel Commit).

The vulnerability exists in the SCSI lpfc driver's handling of NPIV ports sending PLOGIRJT. The issue specifically occurs in two functions: lpfcignoreelscmpl() and lpfcelsrspreject(), where memory allocated from NPIV PLOGIRJT (lpfcrcvplogi()'s login_mbox) could potentially leak. The vulnerability has been assigned a CVSS score of 5.5 MEDIUM (NVD Dashboard).

The vulnerability could lead to memory leaks in the Linux kernel's SCSI subsystem, potentially causing system resource depletion over time (Kernel Commit).

The vulnerability has been patched in the Linux kernel. The fix involves properly freeing allocated memory in both lpfcignoreelscmpl() and lpfcelsrspreject() functions. For lpfcignoreelscmpl(), the fix checks if cmdiocb->contextun.mbox was allocated and frees it back to phba->mboxmempool along with mbox->ctxbuf. For lpfcelsrspreject() failure, both the ctxbuf for service parameters and the loginmbox are properly freed (Kernel Commit).