---
id: CVE-2022-49521
title: 'scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()

  If no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a
  received frame, the frame is d…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e <
    fa1b509d41c5433672f72c0615cf4aefa0611c99
  - >-
    Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e <
    40cf4ea4d2d497f7732c87d350ba5c3f5e8a43a1
  - >-
    Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e <
    08709769ff2fb6c5ffedcda3742700d8ea1618a8
  - >-
    Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e <
    7860d8f8082605b57596aa82d3d438c1fdad9a9e
  - >-
    Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e <
    646db1a560f44236b7278b822ca99a1d3b6ea72c
  - Linux 2.6.31
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:46:03.173614Z'
published: '2025-02-26'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:49:40.238Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49521'
references:
  - url: 'https://git.kernel.org/stable/c/fa1b509d41c5433672f72c0615cf4aefa0611c99'
  - url: 'https://git.kernel.org/stable/c/40cf4ea4d2d497f7732c87d350ba5c3f5e8a43a1'
  - url: 'https://git.kernel.org/stable/c/08709769ff2fb6c5ffedcda3742700d8ea1618a8'
  - url: 'https://git.kernel.org/stable/c/7860d8f8082605b57596aa82d3d438c1fdad9a9e'
  - url: 'https://git.kernel.org/stable/c/646db1a560f44236b7278b822ca99a1d3b6ea72c'
tags:
  - cve.org
epss: 0.00268
epssPercentile: 0.19091
ingestedAt: '2026-11-05T22:38:31.576Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()

If no handler is found in lpfc_complete_unsol_iocb() to match the rctl of a
received frame, the frame is dropped and resources are leaked.

Fix by returning resources when discarding an unhandled frame type.  Update
lpfc_fc_frame_check() handling of NOP basic link service.

## Affected

- `Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e < fa1b509d41c5433672f72c0615cf4aefa0611c99`
- `Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e < 40cf4ea4d2d497f7732c87d350ba5c3f5e8a43a1`
- `Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e < 08709769ff2fb6c5ffedcda3742700d8ea1618a8`
- `Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e < 7860d8f8082605b57596aa82d3d438c1fdad9a9e`
- `Linux >= 4f774513f7b3fe96648b8936f60f835e6ceaa88e < 646db1a560f44236b7278b822ca99a1d3b6ea72c`
- `Linux 2.6.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.