CVE-2022-48823

What it actually does

Reference count imbalance in the qedf SCSI driver causes an I/O request to remain referenced when a LOGO arrives during an active TMF, leaving the request blocked indefinitely and producing a kernel hung-task condition.

Why it matters to the business

Affected Linux systems using QLogic Fibre Channel adapters may suffer storage I/O stalls and system-wide task hangs, resulting in application downtime and requiring a reboot to recover; the large number of downstream kernel packages increases exposure across enterprise fleets.

How an attack unfolds

An attacker with the ability to trigger Fibre Channel fabric events sends a LOGO while a LUN reset or other TMF is in flight; the race leaves the I/O request's refcount elevated, blocking the jbd2 journal thread and hanging the system.

How to fix it

Upgrade the Linux kernel to a fixed version: 5.10.96 or newer for mainline; Debian 11/12/13 packages 5.10.103-1 or 5.16.7-1; Ubuntu 20.04/22.04 HWE and cloud kernels 5.15.0-22 or later per the listed per-package fixes. Reboot after installation.

How to confirm the fix worked

Verify the running kernel version is at or above the listed fixed releases; reproduce the original LOGO+TMF sequence in a test environment and confirm absence of hung-task traces; monitor dmesg for disappearance of qedf refcount warnings.

Typical attack path

1. Establish control over a Fibre Channel target or fabric visible to the victim host
2. Issue a TMF (LUN reset) via the qedf driver
3. Immediately send a LOGO for the same remote port
4. Observe the refcount leak that prevents I/O completion
5. Trigger kernel hung-task timeout on dependent threads such as jbd2

How to detect it

Search kernel logs and systemd journals for the exact call-trace patterns shown in the advisory, especially qedf_eh_device_reset, qedf_initiate_tmf, "fcport is uploading", and subsequent jbd2 blocked messages; correlate with Fibre Channel port state changes.

• qedf_eh_device_reset
• qedf_initiate_tmf
• fcport is uploading, not executing flush
• rport.*Received LOGO request while in state Ready
• INFO: task jbd2.*blocked for more than 120 seconds
• orig io_req.*ref_cnt = 1

What your security team should do

• Apply the kernel updates matching each distribution's fixed package within the next maintenance window
• Prioritize hosts with QLogic/QEDF adapters or heavy Fibre Channel storage workloads
• Add kernel version checks to vulnerability scanning and asset inventory
• Enable hung_task_panic or increase hung_task_timeout temporarily only for diagnostics