Linux kernel (drivers/infiniband/sw/rxe): A null-pointer dereference panics the node whenever queue-pair creation fails

CVSS 7.5CVE-2022-50885Firmware, BMC & network fabriccurated

Impact

A null-pointer dereference panics the node whenever queue-pair creation fails because the underlying UDP socket could not be set up. Cleanup runs before the pointer check, so the failure path itself is the crash - one tenant's failed QP takes the host away from every other tenant.

Who can reach it

Reachable two ways on a node with soft-RoCE (rdma_rxe) loaded: a tenant container holding /dev/infiniband/uverbs* calling create_qp, or an in-kernel consumer - the upstream report is a plain 'mount.cifs' over RDMA. Socket creation is made to fail through namespace/resource conditions the caller influences. Unprivileged; rxe only.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: blacklist/unload rdma_rxe if soft-RoCE is not required, and avoid SMB-Direct/RDMA mounts from untrusted contexts until patched.

References

https://git.kernel.org/stable/c/ee24de095569935eba600f7735e8e8ddea5b418e https://git.kernel.org/stable/c/7340ca9f782be6fbe3f64a134dc112772764f766 https://nvd.nist.gov/vuln/detail/CVE-2022-50885

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.