https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 05:13:07 +0000 https://cve.radiocsirt.org/vuln/cve-2022-48791 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: pm8001: Fix use-after-free for aborted TMF sas_task</p> <p>Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout.</p> <p>When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task().</p> <p>However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb-&gt;task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>scsi: pm8001: Fix use-after-free for aborted TMF sas_task</p> <p>Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout.</p> <p>When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task().</p> <p>However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb-&gt;task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.</p> https://cve.radiocsirt.org/vuln/cve-2022-48791