Vulnerability-Lookup

CVE-2022-50666 (GCVE-0-2022-50666)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-10-15 21:41

Title

RDMA/siw: Fix QP destroy to wait for all references dropped.

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 21:31 UTC

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7061 records in the last 180 days details

References

4 references

URL	Tags
https://git.kernel.org/stable/c/5c75d608fad58301b…
https://git.kernel.org/stable/c/74ad141e995a73076…
https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5…
https://git.kernel.org/stable/c/a3c278807a459e6f5…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 5c75d608fad58301b63e7d69200c13c3a1d411da (git) Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 74ad141e995a730760b1bcfa14854b7f1057d6bc (git) Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737 (git) Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < a3c278807a459e6f50afee6971cabe74cccfb490 (git)	guessed
Linux	Linux	Affected: 5.3 Unaffected: 0 , < 5.3 (semver) Unaffected: 5.15.75 , ≤ 5.15.* (semver) Unaffected: 5.19.17 , ≤ 5.19.* (semver) Unaffected: 6.0.3 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-50666",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:31:53.314545Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T21:41:22.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw.h",
            "drivers/infiniband/sw/siw/siw_qp.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5c75d608fad58301b63e7d69200c13c3a1d411da",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "74ad141e995a730760b1bcfa14854b7f1057d6bc",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "a3c278807a459e6f50afee6971cabe74cccfb490",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw.h",
            "drivers/infiniband/sw/siw/siw_qp.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix QP destroy to wait for all references dropped.\n\nDelay QP destroy completion until all siw references to QP are\ndropped. The calling RDMA core will free QP structure after\nsuccessful return from siw_qp_destroy() call, so siw must not\nhold any remaining reference to the QP upon return.\nA use-after-free was encountered in xfstest generic/460, while\ntesting NFSoRDMA. Here, after a TCP connection drop by peer,\nthe triggered siw_cm_work_handler got delayed until after\nQP destroy call, referencing a QP which has already freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Soft-iWARP processes peer TCP close in-kernel via siw_cm_llp_state_change \u2192 SIW_CM_WORK_PEER_CLOSE; a remote peer to an SIW listener (e.g. NFS/RDMA) triggers the UAF over the network, as in the NFSoRDMA xfstest report.\nAC:L - The attacker initiates the TCP drop that both queues the delayed CM work and drives local QP teardown; they control both sides of the race and can retry disconnects until the UAF hits.\nPR:N - QP association and teardown race on the SIW/IWARP accept and peer-close path (e.g. svc_rdma creates the QP at rdma_accept) before NFS or other application authentication, so no credentials on the target are required.\nUI:N - Exploitation needs only connecting to an already-listening SIW endpoint and dropping the TCP connection; no extra victim user action is required.\nS:U - Impact is kernel memory corruption and privilege escalation within the same host kernel authority, with no VM escape or other cross-boundary scope change.\nC:H - Use-after-free of the QP object allows heap reuse and attacker-controlled content in the freed structure, enabling arbitrary kernel memory disclosure.\nI:H - The same UAF provides a heap corruption primitive (kref ops and field writes in siw_qp_llp_close/siw_cm_work_handler on freed memory) usable for arbitrary write and control-flow hijacking.\nA:H - Accessing the freed QP in the CM work handler causes kernel oops/crash even without full exploitation, which is a full availability impact and can be repeated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:18.159Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3c278807a459e6f50afee6971cabe74cccfb490"
        }
      ],
      "title": "RDMA/siw: Fix QP destroy to wait for all references dropped.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50666",
    "datePublished": "2025-12-09T01:29:16.813Z",
    "dateReserved": "2025-12-09T01:26:45.990Z",
    "dateUpdated": "2026-10-15T21:41:22.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50666",
      "date": "2026-10-23",
      "epss": "0.00733",
      "percentile": "0.53871"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw.h",
                  "drivers/infiniband/sw/siw/siw_qp.c",
                  "drivers/infiniband/sw/siw/siw_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5c75d608fad58301b63e7d69200c13c3a1d411da",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "74ad141e995a730760b1bcfa14854b7f1057d6bc",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3c278807a459e6f50afee6971cabe74cccfb490",
                    "status": "affected",
                    "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/sw/siw/siw.h",
                  "drivers/infiniband/sw/siw/siw_qp.c",
                  "drivers/infiniband/sw/siw/siw_verbs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix QP destroy to wait for all references dropped.\n\nDelay QP destroy completion until all siw references to QP are\ndropped. The calling RDMA core will free QP structure after\nsuccessful return from siw_qp_destroy() call, so siw must not\nhold any remaining reference to the QP upon return.\nA use-after-free was encountered in xfstest generic/460, while\ntesting NFSoRDMA. Here, after a TCP connection drop by peer,\nthe triggered siw_cm_work_handler got delayed until after\nQP destroy call, referencing a QP which has already freed."
          }
        ],
        "id": "CVE-2022-50666",
        "lastModified": "2026-10-15T22:17:32.177",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-50666",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:31:53.314545Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-12-09T16:17:18.600",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3c278807a459e6f50afee6971cabe74cccfb490"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:37:54+00:00",
      "cve": "CVE-2022-50666",
      "id": "CVE-2022-50666",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/siw: Fix QP destroy to wait for all references dropped",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50666.json",
      "version": "3"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-50666 (GCVE-0-2022-50666)

WID-SEC-W-2025-2765

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour