CVE-2022-50129
published 2025-06-18CVE-2022-50129: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.16%
5.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix a use-after-free
Change the LIO port members inside struct srpt_port from regular members
into pointers. Allocate the LIO port data structures from inside
srpt_make_tport() and free these from inside srpt_make_tport(). Keep
struct srpt_device as long as either an RDMA port or a LIO target port is
associated with it. This patch decouples the lifetime of struct srpt_port
(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).
This patch fixes the following KASAN complaint:
BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]
Read of size 8 at addr ffff888141cc34b8 by task check/5093
Call Trace:
show_stack+0x4e/0x53
dump_stack_lvl+0x51/0x66
print_address_description.constprop.0.cold+0xea/0x41e
print_report.cold+0x90/0x205
kasan_report+0xb9/0xf0
__asan_load8+0x69/0x90
srpt_enable_tpg+0x31/0x70 [ib_srpt]
target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod]
configfs_write_iter+0x18b/0x210
new_sync_write+0x1f2/0x2f0
vfs_write+0x3e3/0x540
ksys_write+0xbb/0x140
__x64_sys_write+0x42/0x50
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a42d985bd5b234da8b61347a78dc3057bf7bb94d < de95b52d9aabc979166aba81ccbe623aaf9c16a1 | de95b52d9aabc979166aba81ccbe623aaf9c16a1 |
| linux | linux | >= a42d985bd5b234da8b61347a78dc3057bf7bb94d < e60d7e2462bf57273563c4e00dbfa79ee973b9e2 | e60d7e2462bf57273563c4e00dbfa79ee973b9e2 |
| linux | linux | >= a42d985bd5b234da8b61347a78dc3057bf7bb94d < 4ee8c39968a648d58b273582d4b021044a41ee5e | 4ee8c39968a648d58b273582d4b021044a41ee5e |
| linux | linux | >= a42d985bd5b234da8b61347a78dc3057bf7bb94d < 388326bb1c32fcd09371c1d494af71471ef3a04b | 388326bb1c32fcd09371c1d494af71471ef3a04b |
| linux | linux | >= a42d985bd5b234da8b61347a78dc3057bf7bb94d < b5605148e6ce36bb21020d49010b617693933128 | b5605148e6ce36bb21020d49010b617693933128 |
| linux | linux_kernel | >= 0 < 5.10.140-1 | 5.10.140-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 3.3 < 5.10.137 | 5.10.137 |
| linux | linux_kernel | >= 5.11 < 5.15.61 | 5.15.61 |
| linux | linux_kernel | >= 5.16 < 5.18.18 | 5.18.18 |
| linux | linux_kernel | >= 5.19 < 5.19.2 | 5.19.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: RDMA/srpt: Fix a use-after-free
vendor_redhat·2025-06-18·CVSS 7.8
CVE-2022-50129 [HIGH] CWE-416 kernel: RDMA/srpt: Fix a use-after-free
kernel: RDMA/srpt: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix a use-after-free
Change the LIO port members inside struct srpt_port from regular members
into pointers. Allocate the LIO port data structures from inside
srpt_make_tport() and free these from inside srpt_make_tport(). Keep
struct srpt_device as long as either an RDMA port or a LIO target port is
associated with it. This patch decouples the lifetime of struct srpt_port
(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).
This patch fixes the following KASAN complaint:
BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]
Read of size 8 at addr ffff888141cc34b8 by task check/5093
Call Trace:
show_stack+0x4e/0x53
dump_stack_lvl+0x51/0x
Debian
CVE-2022-50129: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: ...
vendor_debian·2022·CVSS 7.8
CVE-2022-50129 [HIGH] CVE-2022-50129: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: ...
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from regular members into pointers. Allocate the LIO port data structures from inside srpt_make_tport() and free these from inside srpt_make_tport(). Keep struct srpt_device as long as either an RDMA port or a LIO target port is associated with it. This patch decouples the lifetime of struct srpt_port (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO). This patch fixes the following KASAN complaint: BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt] Read of size 8 at addr ffff888141cc34b8 by task check/5093 Call Trace: show_stack+0x4e/0x53 dump_stack_lvl+0x51/0x66 print_address_description.constprop.0.c
GHSA
GHSA-xjxc-h2mp-hqg8: In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix a use-after-free
Change the LIO port members inside struct srpt_p
ghsa_unreviewed·2025-06-18
CVE-2022-50129 [HIGH] CWE-416 GHSA-xjxc-h2mp-hqg8: In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix a use-after-free
Change the LIO port members inside struct srpt_p
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix a use-after-free
Change the LIO port members inside struct srpt_port from regular members
into pointers. Allocate the LIO port data structures from inside
srpt_make_tport() and free these from inside srpt_make_tport(). Keep
struct srpt_device as long as either an RDMA port or a LIO target port is
associated with it. This patch decouples the lifetime of struct srpt_port
(controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).
This patch fixes the following KASAN complaint:
BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]
Read of size 8 at addr ffff888141cc34b8 by task check/5093
Call Trace:
show_stack+0x4e/0x53
dump_stack_lvl+0x51/0x66
print_address_description.constpro
OSV
CVE-2022-50129: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_por
osv·2025-06-18·CVSS 7.8
CVE-2022-50129 [HIGH] CVE-2022-50129: In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_por
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from regular members into pointers. Allocate the LIO port data structures from inside srpt_make_tport() and free these from inside srpt_make_tport(). Keep struct srpt_device as long as either an RDMA port or a LIO target port is associated with it. This patch decouples the lifetime of struct srpt_port (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO). This patch fixes the following KASAN complaint: BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt] Read of size 8 at addr ffff888141cc34b8 by task check/5093 Call Trace: show_stack+0x4e/0x53 dump_stack_lvl+0x51/0x66 print_address_description.constprop.0.c
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/388326bb1c32fcd09371c1d494af71471ef3a04bhttps://git.kernel.org/stable/c/4ee8c39968a648d58b273582d4b021044a41ee5ehttps://git.kernel.org/stable/c/b5605148e6ce36bb21020d49010b617693933128https://git.kernel.org/stable/c/de95b52d9aabc979166aba81ccbe623aaf9c16a1https://git.kernel.org/stable/c/e60d7e2462bf57273563c4e00dbfa79ee973b9e2
2025-06-18
Published