GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50666 (GCVE-0-2022-50666)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-08-05 08:59
VLAI
Title
RDMA/siw: Fix QP destroy to wait for all references dropped.
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 5c75d608fad58301b63e7d69200c13c3a1d411da (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 74ad141e995a730760b1bcfa14854b7f1057d6bc (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737 (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < a3c278807a459e6f50afee6971cabe74cccfb490 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw.h",
            "drivers/infiniband/sw/siw/siw_qp.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c75d608fad58301b63e7d69200c13c3a1d411da",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "74ad141e995a730760b1bcfa14854b7f1057d6bc",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "a3c278807a459e6f50afee6971cabe74cccfb490",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw.h",
            "drivers/infiniband/sw/siw/siw_qp.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix QP destroy to wait for all references dropped.\n\nDelay QP destroy completion until all siw references to QP are\ndropped. The calling RDMA core will free QP structure after\nsuccessful return from siw_qp_destroy() call, so siw must not\nhold any remaining reference to the QP upon return.\nA use-after-free was encountered in xfstest generic/460, while\ntesting NFSoRDMA. Here, after a TCP connection drop by peer,\nthe triggered siw_cm_work_handler got delayed until after\nQP destroy call, referencing a QP which has already freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Soft-iWARP processes peer TCP close in-kernel via siw_cm_llp_state_change \u2192 SIW_CM_WORK_PEER_CLOSE; a remote peer to an SIW listener (e.g. NFS/RDMA) triggers the UAF over the network, as in the NFSoRDMA xfstest report.\nAC:L - The attacker initiates the TCP drop that both queues the delayed CM work and drives local QP teardown; they control both sides of the race and can retry disconnects until the UAF hits.\nPR:N - QP association and teardown race on the SIW/IWARP accept and peer-close path (e.g. svc_rdma creates the QP at rdma_accept) before NFS or other application authentication, so no credentials on the target are required.\nUI:N - Exploitation needs only connecting to an already-listening SIW endpoint and dropping the TCP connection; no extra victim user action is required.\nS:U - Impact is kernel memory corruption and privilege escalation within the same host kernel authority, with no VM escape or other cross-boundary scope change.\nC:H - Use-after-free of the QP object allows heap reuse and attacker-controlled content in the freed structure, enabling arbitrary kernel memory disclosure.\nI:H - The same UAF provides a heap corruption primitive (kref ops and field writes in siw_qp_llp_close/siw_cm_work_handler on freed memory) usable for arbitrary write and control-flow hijacking.\nA:H - Accessing the freed QP in the CM work handler causes kernel oops/crash even without full exploitation, which is a full availability impact and can be repeated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:18.159Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3c278807a459e6f50afee6971cabe74cccfb490"
        }
      ],
      "title": "RDMA/siw: Fix QP destroy to wait for all references dropped.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50666",
    "datePublished": "2025-12-09T01:29:16.813Z",
    "dateReserved": "2025-12-09T01:26:45.990Z",
    "dateUpdated": "2026-08-05T08:59:18.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50666",
      "date": "2026-09-19",
      "epss": "0.00733",
      "percentile": "0.52884"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw.h",
                  "drivers/infiniband/sw/siw/siw_qp.c",
                  "drivers/infiniband/sw/siw/siw_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5c75d608fad58301b63e7d69200c13c3a1d411da",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "74ad141e995a730760b1bcfa14854b7f1057d6bc",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3c278807a459e6f50afee6971cabe74cccfb490",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw.h",
                  "drivers/infiniband/sw/siw/siw_qp.c",
                  "drivers/infiniband/sw/siw/siw_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix QP destroy to wait for all references dropped.\n\nDelay QP destroy completion until all siw references to QP are\ndropped. The calling RDMA core will free QP structure after\nsuccessful return from siw_qp_destroy() call, so siw must not\nhold any remaining reference to the QP upon return.\nA use-after-free was encountered in xfstest generic/460, while\ntesting NFSoRDMA. Here, after a TCP connection drop by peer,\nthe triggered siw_cm_work_handler got delayed until after\nQP destroy call, referencing a QP which has already freed."
          }
        ],
        "id": "CVE-2022-50666",
        "lastModified": "2026-08-04T10:18:20.697",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-09T16:17:18.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3c278807a459e6f50afee6971cabe74cccfb490"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:37:54+00:00",
      "cve": "CVE-2022-50666",
      "id": "CVE-2022-50666",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/siw: Fix QP destroy to wait for all references dropped",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50666.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:33:49Z",
      "cve": "CVE-2022-50666",
      "id": "CVE-2022-50666",
      "initial_release_date": "2025-12-10T00:38:27Z",
      "product_status:known_affected": "421",
      "product_status:known_not_affected": "320",
      "product_status:recommended": "196",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50666",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50666.json",
      "version": "24"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.