CVE-2022-50666
RDMA/siw: Fix QP destroy to wait for all references dropped.
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
Timeline
ID reserved
By Linux
Published
- 10 months later
· 10 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.73% · top 45% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b – < 5c75d608fad58301b63e7d69200c13c3a1d411da
- affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b – < 74ad141e995a730760b1bcfa14854b7f1057d6bc
- affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b – < 0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737
- affected 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b – < a3c278807a459e6f50afee6971cabe74cccfb490
- affected 5.3
- unaffected < 5.3
- unaffected 5.15.75 – ≤ 5.15.*
- unaffected 5.19.17 – ≤ 5.19.*
- unaffected 6.0.3 – ≤ 6.0.*
- unaffected 6.1 – ≤ *
References (4)
- https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da (opens in a new tab)
- https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc (opens in a new tab)
- https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737 (opens in a new tab)
- https://git.kernel.org/stable/c/a3c278807a459e6f50afee6971cabe74cccfb490 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-50666)Record last updated .