In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed

There is a null-ptr-deref when mount.cifs over rdma:

BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
Read of size 8 at addr 0000000000000018 by task mount.cifs/3046

CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x44
kasan_report+0xad/0x130
rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
execute_in_process_context+0x25/0x90
__rxe_cleanup+0x101/0x1d0 [rdma_rxe]
rxe_create_qp+0x16a/0x180 [rdma_rxe]
create_qp.part.0+0x27d/0x340
ib_create_qp_kernel+0x73/0x160
rdma_create_qp+0x100/0x230
_smbd_get_connection+0x752/0x20f0
smbd_get_connection+0x21/0x40
cifs_get_tcp_session+0x8ef/0xda0
mount_get_conns+0x60/0x750
cifs_mount+0x103/0xd00
cifs_smb3_do_mount+0x1dd/0xcb0
smb3_get_tree+0x1d5/0x300
vfs_get_tree+0x41/0xf0
path_mount+0x9b3/0xdd0
__x64_sys_mount+0x190/0x1d0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0

The root cause of the issue is the socket create failed in
rxe_qp_init_req().

So move the reset rxe_qp_do_cleanup() after the NULL ptr check.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < ee24de095569935eba600f7735e8e8ddea5b418e
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < 7340ca9f782be6fbe3f64a134dc112772764f766
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < bd7106a6004f1077a365ca7f5a99c7a708e20714
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < 6bb5a62bfd624039b05157745c234068508393a9
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < f64f08b9e6fb305a25dd75329e06ae342b9ce336
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < 5b924632d84a60bc0c7fe6e9bbbce99d03908957
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < 821f9a18210f6b9fd6792471714c799607b25db4
8700e3e7c4857d28ebaa824509934556da0b3e76 affected < f67376d801499f4fa0838c18c1efcad8840e550d
Linux Linux affected
Version Status Constraints
4.8 affected —
0 unaffected < 4.8
4.14.303 unaffected ≤ 4.14.*
4.19.270 unaffected ≤ 4.19.*
5.4.229 unaffected ≤ 5.4.*
5.10.163 unaffected ≤ 5.10.*
5.15.86 unaffected ≤ 5.15.*
6.0.16 unaffected ≤ 6.0.*
6.1.2 unaffected ≤ 6.1.*
6.2 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/5b924632d84a60bc0c7fe6e9bbbce99d03908957 cve-icon cve-icon
https://git.kernel.org/stable/c/6bb5a62bfd624039b05157745c234068508393a9 cve-icon cve-icon
https://git.kernel.org/stable/c/7340ca9f782be6fbe3f64a134dc112772764f766 cve-icon cve-icon
https://git.kernel.org/stable/c/821f9a18210f6b9fd6792471714c799607b25db4 cve-icon cve-icon
https://git.kernel.org/stable/c/bd7106a6004f1077a365ca7f5a99c7a708e20714 cve-icon cve-icon
https://git.kernel.org/stable/c/ee24de095569935eba600f7735e8e8ddea5b418e cve-icon cve-icon
https://git.kernel.org/stable/c/f64f08b9e6fb305a25dd75329e06ae342b9ce336 cve-icon cve-icon
https://git.kernel.org/stable/c/f67376d801499f4fa0838c18c1efcad8840e550d cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025123020-CVE-2022-50885-c207@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-50885 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-50885 cve-icon
History

Wed, 31 Dec 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 30 Dec 2025 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] Read of size 8 at addr 0000000000000018 by task mount.cifs/3046 CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xad/0x130 rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] execute_in_process_context+0x25/0x90 __rxe_cleanup+0x101/0x1d0 [rdma_rxe] rxe_create_qp+0x16a/0x180 [rdma_rxe] create_qp.part.0+0x27d/0x340 ib_create_qp_kernel+0x73/0x160 rdma_create_qp+0x100/0x230 _smbd_get_connection+0x752/0x20f0 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The root cause of the issue is the socket create failed in rxe_qp_init_req(). So move the reset rxe_qp_do_cleanup() after the NULL ptr check.
Title RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-12-30T12:34:12.093Z

Reserved: 2025-12-30T12:26:05.425Z

Link: CVE-2022-50885

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-12-30T13:16:03.603

Modified: 2025-12-31T20:43:05.160

Link: CVE-2022-50885

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-12-30T00:00:00Z

Links: CVE-2022-50885 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.