CVE-2022-50744: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50744 is a hard lockup vulnerability in the Linux kernel's SCSI lpfc (Fibre Channel) driver that can cause a kernel panic and system-wide denial of service. The flaw exists in the lpfc_rx_monitor_report function, where an insufficient spin lock (spin_lock_bh) fails to protect against timer interrupts when the debugfs rx_monitor interface is read concurrently with active I/O operations. It affects Linux kernel versions across multiple stable branches, with patches available in kernel versions 5.15.86, 6.0.16, 6.1.2, and 6.2. The CVE was published on December 24, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper locking primitive in the lpfc_rx_monitor_report function within the Linux kernel's lpfc SCSI driver (CWE-667: Improper Locking). The function uses spin_lock_bh, which disables only bottom-half (softirq) processing but does not protect against hardware interrupt context — specifically, the APIC timer interrupt that triggers lpfc_cmf_timer. When a user reads /sys/kernel/debug/lpfc/fnX/rx_monitor (e.g., via cat) while I/O is in progress, the timer interrupt fires and attempts to acquire the same spin lock already held by the read path, resulting in a deadlock and hard CPU lockup. The fix upgrades the lock to spin_lock_irq / spin_lock_irqsave to disable hardware interrupts during the critical section (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes a kernel panic ("Hard LOCKUP") that renders the affected system completely unresponsive, resulting in a full denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems running the lpfc Fibre Channel driver (common in enterprise SAN environments) are at risk of unplanned downtime, loss of in-flight I/O operations, and potential data loss if storage transactions are interrupted (Red Hat Bugzilla, Red Hat Advisory).

1. Precondition check: Confirm the target system has an lpfc Fibre Channel HBA installed, the lpfc kernel module loaded, and active I/O operations in progress.
2. Gain local access: Obtain a local shell session with at least low-privilege user access on the target system.
3. Verify debugfs mount: Confirm that debugfs is mounted at /sys/kernel/debug (standard on most Linux distributions).
4. Trigger the race condition: Execute cat /sys/kernel/debug/lpfc/fnX/rx_monitor (where fnX corresponds to the lpfc function node, e.g., fn0) while the system is under I/O load. The concurrent APIC timer interrupt firing lpfc_cmf_timer will attempt to acquire the same spin lock, causing a deadlock.
5. Result: The CPU enters a hard lockup state, triggering a kernel panic and system crash (Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/messages) entries showing Kernel panic - not syncing: Hard LOCKUP with CPU: X PID: XXXXXX Comm: cat; stack traces referencing lpfc_rx_monitor_report, lpfc_rx_monitor_read, lpfc_cmf_timer, and native_queued_spin_lock_slowpath.
• Process: Presence of a cat process reading /sys/kernel/debug/lpfc/fnX/rx_monitor at the time of system freeze.
• System State: System becomes completely unresponsive (hard lockup); kdump capture (if configured) will show the call trace involving lpfc module functions and hrtimer_interrupt (Red Hat Bugzilla).

Apply the upstream kernel patches included in stable releases 5.15.86, 6.0.16, 6.1.2, and 6.2 or later, which replace spin_lock_bh with spin_lock_irq in lpfc_rx_monitor_report. As a workaround prior to patching, restrict access to the debugfs interface (e.g., mount debugfs with restricted permissions or unmount it entirely) and avoid reading /sys/kernel/debug/lpfc/fnX/rx_monitor during active I/O. SUSE has also issued kernel security updates addressing this CVE (Red Hat Advisory, Red Hat Bugzilla).