CVE-2022-50666
published 2025-12-09CVE-2022-50666: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion…
PriorityP345critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.73%
53.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped.
Delay QP destroy completion until all siw references to QP are
dropped. The calling RDMA core will free QP structure after
successful return from siw_qp_destroy() call, so siw must not
hold any remaining reference to the QP upon return.
A use-after-free was encountered in xfstest generic/460, while
testing NFSoRDMA. Here, after a TCP connection drop by peer,
the triggered siw_cm_work_handler got delayed until after
QP destroy call, referencing a QP which has already freed.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.3-1 (bookworm) | linux 6.0.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < 5c75d608fad58301b63e7d69200c13c3a1d411da | 5c75d608fad58301b63e7d69200c13c3a1d411da |
| linux | linux | >= 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < 74ad141e995a730760b1bcfa14854b7f1057d6bc | 74ad141e995a730760b1bcfa14854b7f1057d6bc |
| linux | linux | >= 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < 0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737 | 0ed8bf9d0bb19f3f5eedd73f04aaf5bba9ac0737 |
| linux | linux | >= 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b < a3c278807a459e6f50afee6971cabe74cccfb490 | a3c278807a459e6f50afee6971cabe74cccfb490 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 0 < 6.0.3-1 | 6.0.3-1 |
| linux | linux_kernel | >= 5.16.0 < 5.19.17 | 5.19.17 |
| linux | linux_kernel | >= 5.20.0 < 6.0.3 | 6.0.3 |
| linux | linux_kernel | >= 5.3.0 < 5.15.75 | 5.15.75 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: RDMA/siw: Fix QP destroy to wait for all references dropped
vendor_redhat·2025-12-09·CVSS 5.9
CVE-2022-50666 [MEDIUM] CWE-416 kernel: RDMA/siw: Fix QP destroy to wait for all references dropped
kernel: RDMA/siw: Fix QP destroy to wait for all references dropped
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped.
Delay QP destroy completion until all siw references to QP are
dropped. The calling RDMA core will free QP structure after
successful return from siw_qp_destroy() call, so siw must not
hold any remaining reference to the QP upon return.
A use-after-free was encountered in xfstest generic/460, while
testing NFSoRDMA. Here, after a TCP connection drop by peer,
the triggered siw_cm_work_handler got delayed until after
QP destroy call, referencing a QP which has already freed.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2022-50666: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: F...
vendor_debian·2022
CVE-2022-50666 CVE-2022-50666: linux - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: F...
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
Scope: local
bookworm: resolved (fixed in 6.0.3-1)
bullseye: open
forky: resolved (fixed in 6.0.3-1)
sid: resolved (fixed in 6.0.3-1)
trixie: resolved (fixed in 6.0.3-1)
GHSA
GHSA-mppj-wh3r-grwx: In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped
ghsa_unreviewed·2025-12-09
CVE-2022-50666 GHSA-mppj-wh3r-grwx: In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped.
Delay QP destroy completion until all siw references to QP are
dropped. The calling RDMA core will free QP structure after
successful return from siw_qp_destroy() call, so siw must not
hold any remaining reference to the QP upon return.
A use-after-free was encountered in xfstest generic/460, while
testing NFSoRDMA. Here, after a TCP connection drop by peer,
the triggered siw_cm_work_handler got delayed until after
QP destroy call, referencing a QP which has already freed.
OSV
RDMA/siw: Fix QP destroy to wait for all references dropped.
osv·2025-12-09
CVE-2022-50666 RDMA/siw: Fix QP destroy to wait for all references dropped.
RDMA/siw: Fix QP destroy to wait for all references dropped.
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped.
Delay QP destroy completion until all siw references to QP are
dropped. The calling RDMA core will free QP structure after
successful return from siw_qp_destroy() call, so siw must not
hold any remaining reference to the QP upon return.
A use-after-free was encountered in xfstest generic/460, while
testing NFSoRDMA. Here, after a TCP connection drop by peer,
the triggered siw_cm_work_handler got delayed until after
QP destroy call, referencing a QP which has already freed.
OSV
CVE-2022-50666: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped
osv·2025-12-09
CVE-2022-50666 CVE-2022-50666: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
No detection rules found.
No public exploits indexed.
2025-12-09
Published