CVE-2022-50840

What it actually does

Use-after-free in snic_tgt_create() when device_add() fails: the tgt structure is kfree'd but &tgt->list remains on snic->disc.tgt_list, so later list traversals dereference freed memory.

Why it matters to the business

Systems running the affected Linux kernel with the snic SCSI driver may experience kernel panics, memory corruption, or potential local privilege escalation; the issue affects storage target discovery paths in enterprise and cloud Linux deployments.

How an attack unfolds

An attacker with local access triggers a failure path in device_add() during snic target creation so that the tgt object is freed while still linked; subsequent iteration over snic->disc.tgt_list then accesses the freed object, enabling UAF exploitation for crash or code execution.

How to fix it

Apply the upstream fix in commit f9d8b8ba0f1a16cde0b1fc9e80466df76b6db8ff (or later stable backports) that removes tgt from snic->disc.tgt_list before freeing it; rebuild and reboot into the patched kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting drivers/scsi/snic/snic_disc.c for the list_del() call before kfree in snic_tgt_create(); run targeted fault-injection tests that induce device_add() failure and verify no UAF warnings from KASAN or Smatch.

Typical attack path

1. Obtain local code execution on a Linux host using the snic driver
2. Force device_add() to fail inside snic_tgt_create() (e.g., via resource exhaustion or fault injection)
3. Trigger list traversal of snic->disc.tgt_list to dereference the freed tgt object
4. Leverage the resulting UAF for kernel memory corruption or control-flow hijack

How to detect it

Review kernel logs for KASAN or BUG reports referencing snic_tgt_create or snic_disc.c; inspect crash dumps for use-after-free patterns involving tgt_list structures; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel upgrade to a version containing f9d8b8ba0f1a16cde0b1fc9e80466df76b6db8ff on all hosts using the snic driver
• Enable KASAN or similar memory-safety instrumentation in test environments to validate the fix
• Monitor vendor advisories for distribution-specific backports and schedule maintenance windows accordingly