CVE-2022-49536 is a vulnerability identified in the Linux kernel's SCSI subsystem, specifically within the lpfc (LightPulse Fibre Channel) driver. The issue arises from a deadlock condition during SCSI I/O completion and abort handling under heavy load scenarios, such as stress I/O tests involving over 500 virtual ports (vports). The deadlock is caused by an inconsistent lock acquisition order between two locks: lpfc_cmd->buf_lock and phba->hbalock. The kernel code paths on two CPUs attempt to acquire these locks in opposite orders, leading to a circular wait and a hard LOCKUP, effectively freezing the system. The vulnerability manifests as a kernel hang or system lockup during intensive SCSI operations, impacting system availability. The fix involves reordering the lock acquisition in the lpfc_abort_handler routine to always acquire lpfc_cmd->buf_lock before phba->hbalock, preventing the deadlock scenario. This vulnerability does not require user interaction or authentication to trigger but does require a specific high-load environment with many vports performing SCSI I/O operations. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The affected versions are specific Linux kernel commits identified by their hashes, indicating the issue is present in certain kernel builds prior to the fix. This vulnerability is primarily a denial-of-service (DoS) risk due to system lockup rather than a direct confidentiality or integrity compromise.

For European organizations, especially those operating data centers, cloud infrastructure, or enterprise storage systems running Linux with Fibre Channel storage networks, this vulnerability poses a significant availability risk. Systems under heavy SCSI I/O load with many virtual ports could experience kernel lockups, leading to service outages or degraded performance. This can impact critical business applications relying on continuous storage access, such as databases, virtualization platforms, and large-scale file servers. The disruption could affect sectors like finance, telecommunications, healthcare, and manufacturing, where Linux-based storage solutions are common. Although no direct data breach or integrity compromise is indicated, prolonged downtime or repeated crashes could lead to operational losses and increased recovery costs. The absence of known exploits reduces immediate risk, but the complexity of the issue means that organizations using affected kernel versions should prioritize patching to maintain system stability and avoid unexpected outages.

1. Apply the official Linux kernel patch that reorders the lock acquisition in the lpfc_abort_handler as soon as it becomes available from trusted Linux kernel maintainers or distribution vendors. 2. Identify and inventory all systems using the affected Linux kernel versions with the vulnerable lpfc driver, focusing on those with high SCSI I/O loads and multiple vports. 3. For critical systems where immediate patching is not feasible, consider reducing the number of virtual ports or limiting concurrent SCSI I/O operations to mitigate the risk of triggering the deadlock. 4. Monitor system logs and kernel messages for signs of lockups or hard LOCKUP call traces related to lpfc operations to detect early symptoms. 5. Implement robust backup and recovery procedures to minimize downtime impact in case of system lockups. 6. Coordinate with hardware vendors for firmware updates or configuration changes that might reduce stress on the SCSI subsystem. 7. Test patches in staging environments under simulated high-load conditions before deployment to production to ensure stability.