CVE-2022-50414: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50414 is a denial-of-service vulnerability in the Linux kernel's SCSI FCoE (Fibre Channel over Ethernet) subsystem caused by improper transport cleanup on initialization failure. When fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport) and the subsequent fcoe_if_init() fails, the transport is not detached, leaving a freed fcoe_sw_transport pointer on the fcoe_transports list. This dangling reference causes a kernel panic (page fault) when the FCoE module is reinserted. The vulnerability was published on September 18, 2025, and affects Linux kernel versions from 2.6.39 through 6.1.x (before 6.1.2). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is a missing error-path cleanup in the FCoE module initialization sequence (classified as NVD-CWE-noinfo due to insufficient information, but functionally a use-after-free/dangling pointer condition). When fcoe_if_init() returns an error, the code path does not call fcoe_transport_detach() to remove fcoe_sw_transport from the global fcoe_transports linked list, leaving a freed memory reference in the list. A subsequent module reinsertion triggers fcoe_transport_attach(), which traverses the list and dereferences the stale pointer, producing a kernel page fault at address fffffbfff82e2213 with the instruction pointer at fcoe_transport_attach+0xe1/0x230 [libfcoe]. Exploitation requires local access with sufficient privileges to load/unload kernel modules (Feedly).

Successful exploitation results in a kernel panic, causing a complete system crash and denial of service — the system becomes unresponsive and requires a reboot. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems using FCoE storage networking (common in enterprise SAN environments) are at risk of unplanned downtime if the FCoE module fails to initialize and is subsequently reloaded (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed for this vulnerability. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to load kernel modules, significantly limiting the attacker pool (Feedly).

Patches have been released for all affected Linux kernel stable branches. Administrators should update to the following minimum versions: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, or 6.1.2. As a workaround where patching is not immediately possible, disabling or blacklisting the fcoe and libfcoe kernel modules (if FCoE is not in use) will prevent the vulnerable code path from being triggered. SUSE has issued kernel security updates addressing this CVE (SUSE Advisory, Red Hat Advisory).