Linux kernel (drivers/infiniband/sw/siw): A remote peer turns a connection drop into a kernel use-after-free. The

CVSS 9.8CVE-2022-50666Firmware, BMC & network fabriccurated

Impact

A remote peer turns a connection drop into a kernel use-after-free. The driver lets queue-pair destruction return while its own connection-manager work still holds references, so the RDMA core frees the QP and the late work handler then operates on freed memory. Rated critical and network-reachable by the kernel CNA.

Who can reach it

A peer on the fabric resets or drops the TCP connection at the moment the local side is tearing the QP down - the upstream report comes from ordinary NFS-over-RDMA testing, so no exotic crafting is needed, and no local credentials are involved. Requires the siw (soft-iWARP) module.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: unload/blacklist siw unless soft-iWARP is deliberately in use, and limit which peers can open iWARP connections to the node.

References

https://git.kernel.org/stable/c/5c75d608fad58301b63e7d69200c13c3a1d411da https://git.kernel.org/stable/c/74ad141e995a730760b1bcfa14854b7f1057d6bc https://nvd.nist.gov/vuln/detail/CVE-2022-50666

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.