CVE-2022-50818: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50818 is a vulnerability in the Linux kernel's SCSI pm8001 driver related to incorrect handling of running_req for internal abort commands. The flaw causes a system hang when disabling a remote PHY for a SATA disk, as the kernel task becomes blocked indefinitely waiting for a workqueue to flush. It was published on December 30, 2025, and affects the Linux kernel (vendor: linux, product: kernel). No CVSS score has been officially assigned at this time (Feedly, Vulners).

The root cause is improper state management (CWE-667: Improper Locking / resource management) in the pm8001 SCSI driver, where internal abort commands incorrectly increment or fail to decrement the running_req counter. When a remote PHY is disabled for a SATA disk, the driver issues internal abort commands, but the running_req count is not properly decremented for these internal commands, causing a subsequent __flush_workqueue call to block indefinitely waiting for the counter to reach zero. The hang manifests as a kernel task (kworker) entering an uninterruptible sleep (state D) for more than 30 seconds, as shown in the kernel trace. Fixes are available via upstream kernel commits (Kernel Git, Kernel Git, Kernel Git).

Successful triggering of this vulnerability results in a denial-of-service condition on the affected Linux system, specifically a kernel task hang that can render the system unresponsive or require a reboot. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems using SAS/SATA storage with the pm8001 HBA driver are at risk, particularly when PHY management operations are performed (Feedly).

Apply the upstream Linux kernel patches that fix the running_req counter handling for internal abort commands in the pm8001 driver. The relevant commits are available at the kernel stable tree (commits 4e750e0, a62b9fc, and d8c22c4). Linux distribution vendors such as SUSE have also issued advisories; users should update to patched kernel packages provided by their distribution. As a temporary workaround, avoid disabling SAS PHYs connected to SATA devices on systems using the pm8001 driver (Kernel Git, Vulners).