CVE-2022-50671

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized. Because of creation of qp fails, the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource. Before calling __rxe_do_task, both qp->req.task.func and qp->req.task.arg should be checked.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/0d773c58d702f0a7c16ee8d69617fd2c28350795
https://git.kernel.org/stable/c/3b8752f086eb6865cc3662ad13249b03024501e5
https://git.kernel.org/stable/c/48cd7098e71735ccafa0b3cf27c53924f9cb5b2f
https://git.kernel.org/stable/c/9c5dd6993c794703e74c6ba17ac78ca0211ef940
https://git.kernel.org/stable/c/a625ca30eff806395175ebad3ac1399014bdb280
https://git.kernel.org/stable/c/bb33fa65da77f5f02dbee6f25cebaeedfcd70028
https://git.kernel.org/stable/c/cdce36a88def550773142a34ef727a830cad96a8
https://git.kernel.org/stable/c/eca119693010032d6cc6e7e9b4fb2c363c7e12ce
https://git.kernel.org/stable/c/f2f405af70e6f0419e718d23fa304798a5405c41

Configurations

No configuration.

History

No history.

Information

Published : 2025-12-09 16:17

Updated : 2026-08-04 10:18

NVD link : CVE-2022-50671

Mitre link : CVE-2022-50671

CVE.ORG link : CVE-2022-50671

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2022-50671", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "48cd7098e71735ccafa0b3cf27c53924f9cb5b2f", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "eca119693010032d6cc6e7e9b4fb2c363c7e12ce", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "9c5dd6993c794703e74c6ba17ac78ca0211ef940", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "0d773c58d702f0a7c16ee8d69617fd2c28350795", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "cdce36a88def550773142a34ef727a830cad96a8", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "f2f405af70e6f0419e718d23fa304798a5405c41", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "bb33fa65da77f5f02dbee6f25cebaeedfcd70028", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "3b8752f086eb6865cc3662ad13249b03024501e5", "versionType": "git"}, {"status": "affected", "version": "8700e3e7c4857d28ebaa824509934556da0b3e76", "lessThan": "a625ca30eff806395175ebad3ac1399014bdb280", "versionType": "git"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_qp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.8"}, {"status": "unaffected", "version": "0", "lessThan": "4.8", "versionType": "semver"}, {"status": "unaffected", "version": "4.9.331", "versionType": "semver", "lessThanOrEqual": "4.9.*"}, {"status": "unaffected", "version": "4.14.296", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.262", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.220", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.150", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.75", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.19.17", "versionType": "semver", "lessThanOrEqual": "5.19.*"}, {"status": "unaffected", "version": "6.0.3", "versionType": "semver", "lessThanOrEqual": "6.0.*"}, {"status": "unaffected", "version": "6.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/sw/rxe/rxe_qp.c"], "defaultStatus": "affected"}]}], "published": "2025-12-09T16:17:19.227", "references": [{"url": "https://git.kernel.org/stable/c/0d773c58d702f0a7c16ee8d69617fd2c28350795", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3b8752f086eb6865cc3662ad13249b03024501e5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/48cd7098e71735ccafa0b3cf27c53924f9cb5b2f", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9c5dd6993c794703e74c6ba17ac78ca0211ef940", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a625ca30eff806395175ebad3ac1399014bdb280", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bb33fa65da77f5f02dbee6f25cebaeedfcd70028", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cdce36a88def550773142a34ef727a830cad96a8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eca119693010032d6cc6e7e9b4fb2c363c7e12ce", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f2f405af70e6f0419e718d23fa304798a5405c41", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix \"kernel NULL pointer dereference\" error\n\nWhen rxe_queue_init in the function rxe_qp_init_req fails,\nboth qp->req.task.func and qp->req.task.arg are not initialized.\n\nBecause of creation of qp fails, the function rxe_create_qp will\ncall rxe_qp_do_cleanup to handle allocated resource.\n\nBefore calling __rxe_do_task, both qp->req.task.func and\nqp->req.task.arg should be checked."}], "lastModified": "2026-08-04T10:18:20.933", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}