Linux kernel (drivers/infiniband/sw/rxe): Any tenant that can open an RDMA verbs device can oops the node. A queue-pair

CVSS 5.5CVE-2022-50127Firmware, BMC & network fabriccurated

Impact

Any tenant that can open an RDMA verbs device can oops the node. A queue-pair creation that fails part-way unwinds into cleanup code that grabs a spinlock which was never initialized, killing the kernel thread in an unrecoverable state and taking every other tenant sharing the box down with it.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* issues an ordinary create_qp with attributes that make initialization fail (oversized capabilities, exhausted resources). No privilege beyond the device node is required, and the failure is tenant-controlled so it is repeatable rather than a rare race. Only applies where the soft-RoCE driver rdma_rxe is loaded; hardware HCAs do not run this path.

What to do

No fixed release is published in this record - pull the stable fix commits (backported across the 5.x series) or run a current stable kernel. Interim: blacklist/unload rdma_rxe if soft-RoCE is not deliberately in use, and stop mapping /dev/infiniband/* into containers that do not need verbs access.

References

https://git.kernel.org/stable/c/3c838ca6fbdb173102780d7bdf18f2f7d9e30979 https://git.kernel.org/stable/c/1a63f24e724f677db1ab21251f4d0011ae0bb5b5 https://nvd.nist.gov/vuln/detail/CVE-2022-50127

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.