GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50137 (GCVE-0-2022-50137)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-08-05 08:57
VLAI
Title
RDMA/irdma: Fix a window for use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a window for use-after-free During a destroy CQ an interrupt may cause processing of a CQE after CQ resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call to irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is called under the cq_lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 92520864ef9f912f38b403d172a0ded020683d55 (git)
Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 0abf2eef80295923b819ce89ff9edc1fe61be17c (git)
Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 350ac793a03c8a30a3f2b27fc282cd1c67070763 (git)
Affected: b48c24c2d710cf34810c555dcef883a3d35a9c08 , < 8ecef7890b3aea78c8bbb501a4b5b8134367b821 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.61 , ≤ 5.15.* (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "92520864ef9f912f38b403d172a0ded020683d55",
              "status": "affected",
              "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
              "versionType": "git"
            },
            {
              "lessThan": "0abf2eef80295923b819ce89ff9edc1fe61be17c",
              "status": "affected",
              "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
              "versionType": "git"
            },
            {
              "lessThan": "350ac793a03c8a30a3f2b27fc282cd1c67070763",
              "status": "affected",
              "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
              "versionType": "git"
            },
            {
              "lessThan": "8ecef7890b3aea78c8bbb501a4b5b8134367b821",
              "status": "affected",
              "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/irdma/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix a window for use-after-free\n\nDuring a destroy CQ an interrupt may cause processing of a CQE after CQ\nresources are freed by irdma_cq_free_rsrc(). Fix this by moving the call\nto irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is\ncalled under the cq_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered by destroying an irdma completion queue through the RDMA verbs path (/dev/infiniband/uverbs* \u2192 ib_uverbs_destroy_cq \u2192 irdma_destroy_cq); no remote packet parser reaches this free path.\nAC:L - An attacker who owns the RDMA context controls both sides of the race\u2014posting work to keep CEQ completions pending and concurrently destroying the CQ\u2014so the window between irdma_cq_free_rsrc() and irdma_sc_cleanup_ceqes() can be hit reliably by retrying.\nPR:L - InfiniBand user verbs are intended for unprivileged processes, and creating/destroying a CQ requires only an RDMA uverbs context, not capabilities in the init user namespace.\nUI:N - The attacker performs the verbs operations themselves; no action by another user is required.\nS:U - The use-after-free corrupts kernel memory within the same OS security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Use-after-free of CQ resources while irdma_process_ceq()/irdma_sc_process_ceq() still handles CEQEs allows reclaim of freed DMA/slab state and attacker-controlled reads via the completion path.\nI:H - The same UAF lets the interrupt path operate on freed/reclaimed CQ state (including irdma_sc_cq_ack() doorbell writes and irdma_iwarp_ce_handler()\u0027s indirect comp_handler call), enabling arbitrary write and control-flow hijack primitives.\nA:H - Even without full exploitation, processing CEQEs against freed CQ resources causes kernel oops/panic in interrupt/softirq context and takes the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:31.640Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/92520864ef9f912f38b403d172a0ded020683d55"
        },
        {
          "url": "https://git.kernel.org/stable/c/0abf2eef80295923b819ce89ff9edc1fe61be17c"
        },
        {
          "url": "https://git.kernel.org/stable/c/350ac793a03c8a30a3f2b27fc282cd1c67070763"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ecef7890b3aea78c8bbb501a4b5b8134367b821"
        }
      ],
      "title": "RDMA/irdma: Fix a window for use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50137",
    "datePublished": "2025-06-18T11:03:00.899Z",
    "dateReserved": "2025-06-18T10:57:27.422Z",
    "dateUpdated": "2026-08-05T08:57:31.640Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50137",
      "date": "2026-09-19",
      "epss": "0.00252",
      "percentile": "0.17032"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/irdma/verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "92520864ef9f912f38b403d172a0ded020683d55",
                    "status": "affected",
                    "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0abf2eef80295923b819ce89ff9edc1fe61be17c",
                    "status": "affected",
                    "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "350ac793a03c8a30a3f2b27fc282cd1c67070763",
                    "status": "affected",
                    "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8ecef7890b3aea78c8bbb501a4b5b8134367b821",
                    "status": "affected",
                    "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/irdma/verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.14"
                  },
                  {
                    "lessThan": "5.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.61",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E529C2C2-B07B-4425-919F-8EC0AB91FA47",
                    "versionEndExcluding": "5.15.61",
                    "versionStartIncluding": "5.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5B42E453-8837-49D0-A5EF-03F818A6DC11",
                    "versionEndExcluding": "5.18.18",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
                    "versionEndExcluding": "5.19.2",
                    "versionStartIncluding": "5.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix a window for use-after-free\n\nDuring a destroy CQ an interrupt may cause processing of a CQE after CQ\nresources are freed by irdma_cq_free_rsrc(). Fix this by moving the call\nto irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is\ncalled under the cq_lock."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/irdma: Se corrige una ventana para el Use-After-Free. Durante un CQ de destrucci\u00f3n, una interrupci\u00f3n puede provocar el procesamiento de un CQE despu\u00e9s de que irdma_cq_free_rsrc() libere recursos CQ. Se soluciona este problema trasladando la llamada a irdma_cq_free_rsrc() despu\u00e9s de irdma_sc_cleanup_ceqes(), que se ejecuta bajo cq_lock."
          }
        ],
        "id": "CVE-2022-50137",
        "lastModified": "2026-08-04T10:18:05.900",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T11:15:43.623",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0abf2eef80295923b819ce89ff9edc1fe61be17c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/350ac793a03c8a30a3f2b27fc282cd1c67070763"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8ecef7890b3aea78c8bbb501a4b5b8134367b821"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/92520864ef9f912f38b403d172a0ded020683d55"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:40:44+00:00",
      "cve": "CVE-2022-50137",
      "id": "CVE-2022-50137",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "631",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/irdma: Fix a window for use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50137.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:26:07Z",
      "cve": "CVE-2022-50137",
      "id": "CVE-2022-50137",
      "initial_release_date": "2025-06-19T03:40:44Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "388",
      "product_status:recommended": "253",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50137",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50137.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.