Linux Kernel CVE-2022-49535

The lpfc driver (cpe:2.3:o:linux:linux_kernel) manages Emulex/Broadcom Fibre Channel Host Bus Adapters. During fabric discovery, the kernel exchanges FLOGI (Fabric Login) and PLOGI (Port Login) ELS frames with FC fabric nodes. Each discovered node is tracked via a nodelist structure (ndlp) whose lifecycle is governed by a reference count. CWE-416 (Use After Free) manifests here in two code paths: (1) in lpfc_issue_els_flogi(), a non-zero return triggers an ndlp reference decrement intended to free the node, but if dev-loss-evt work is already enqueued against that ndlp, the structure is freed before the work handler runs, leaving a dangling pointer; (2) identically in lpfc_cmpl_els_plogi(), a failed PLOGI completion triggers node removal without checking for pending dev-loss-evt, causing lpfc_dev_loss_tmo_handler() to dereference the freed ndlp. The root cause is missing guard logic - the fix adds a pending-work check before decrementing the reference count in FLOGI, PLOGI, PRLI, and ADISC handlers. The adjacent-network CVSS attack vector reflects that triggering these login failures requires presence on the Fibre Channel fabric.