CVE-2022-50840: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50840 is a Use-After-Free (UAF) vulnerability in the Linux kernel's SCSI snic driver, specifically in the snic_tgt_create() function located in drivers/scsi/snic/snic_disc.c. When device_add() fails during target creation, the tgt structure is freed but its embedded list node (tgt->list) is not removed from snic->disc.tgt_list, leaving a dangling pointer that subsequent list traversals can dereference. The vulnerability was introduced with commit c8806b6c9e824f47726f2a9b7fbbe7ebf19306fa (Linux kernel 4.2) and was publicly disclosed on December 30, 2025. It carries an estimated CVSS severity of Medium and an EPSS score of approximately 0.033% (Feedly, EUVD).

The root cause is a missing list removal operation before freeing a kernel object, classified as CWE-416 (Use-After-Free). In snic_tgt_create(), if device_add() returns an error, the code frees the tgt structure via kfree() without first calling list_del() to remove &tgt->list from snic->disc.tgt_list. Any subsequent traversal of tgt_list (e.g., during target discovery or cleanup) will dereference the freed memory, potentially leading to kernel memory corruption. The fix, identified by the Smatch static analysis tool, is to call list_del() on &tgt->list before freeing tgt in the error path (Feedly, EUVD).

Successful exploitation of this UAF could allow a local attacker with access to the SCSI snic subsystem to cause kernel memory corruption, potentially leading to a kernel panic (denial of service) or, in more sophisticated scenarios, privilege escalation by manipulating freed kernel memory. The vulnerability is confined to systems using the Cisco SNIC (Software-defined Networking Interface Card) SCSI driver, limiting its scope to environments with that specific hardware or driver loaded. Confidentiality and integrity impacts depend on the attacker's ability to control the freed memory region before it is reused (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include: 4.9.337, 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. Users should update their Linux kernel to one of these patched versions. As a workaround on systems that do not require the snic driver, administrators can blacklist the snic kernel module to prevent it from loading (echo 'blacklist snic' >> /etc/modprobe.d/blacklist.conf). SUSE has also issued a kernel security advisory addressing this vulnerability (Feedly, Linux Security).

The vulnerability received routine coverage from security scanning vendors including Tenable (Nessus plugin 281718) and Qualys, which added detection for it in their vulnerability management platforms. SUSE issued a kernel security advisory (SUSE-2026:0350-1) addressing this and related issues. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability database entries (Tenable, Linux Security).