GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50736 (GCVE-0-2022-50736)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:22 – Updated: 2026-08-05 08:59
VLAI
Title
RDMA/siw: Fix immediate work request flush to completion queue
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERROR state. An undefined ocode value results in out-of-bounds access to an array for mapping the opcode between siw internal and RDMA core representation in work completion generation. It resulted in a KASAN BUG report of type 'global-out-of-bounds' during NFSoRDMA testing. This patch further fixes a potential case of a malicious user which may write undefined values for completion queue elements status or opcode, if the CQ is memory mapped to user land. It avoids the same out-of-bounds access to arrays for status and opcode mapping as described above.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 6af043089d3f1210776d19b6fdabea610d4c7699 (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 75af03fdf35acf15a3977f7115f6b8d10dff4bc7 (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6 (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < 355d2eca68c10d713a42f68e62044b3d1c300471 (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < f3d26a8589dfdeff328779b511f71fb90b10005e (git)
Affected: 303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b , < bdf1da5df9da680589a7f74448dd0a94dd3e1446 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cq.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6af043089d3f1210776d19b6fdabea610d4c7699",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "75af03fdf35acf15a3977f7115f6b8d10dff4bc7",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "355d2eca68c10d713a42f68e62044b3d1c300471",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "f3d26a8589dfdeff328779b511f71fb90b10005e",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            },
            {
              "lessThan": "bdf1da5df9da680589a7f74448dd0a94dd3e1446",
              "status": "affected",
              "version": "303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_cq.c",
            "drivers/infiniband/sw/siw/siw_verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Fix immediate work request flush to completion queue\n\nCorrectly set send queue element opcode during immediate work request\nflushing in post sendqueue operation, if the QP is in ERROR state.\nAn undefined ocode value results in out-of-bounds access to an array\nfor mapping the opcode between siw internal and RDMA core representation\nin work completion generation. It resulted in a KASAN BUG report\nof type \u0027global-out-of-bounds\u0027 during NFSoRDMA testing.\n\nThis patch further fixes a potential case of a malicious user which may\nwrite undefined values for completion queue elements status or opcode,\nif the CQ is memory mapped to user land. It avoids the same out-of-bounds\naccess to arrays for status and opcode mapping as described above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable paths are local RDMA uverbs operations on SoftiWARP: a user mmaps a CQ, poisons CQE opcode/status, and triggers siw_reap_cqe via destroy/flush (or the in-kernel post_send flush path). Remote iWARP peers do not supply CQE opcode/status fields.\nAC:L - An attacker fully controls CQ creation, mmap writes of SIW_WQE_VALID plus arbitrary __u8 opcode/__u16 status, and CQ destroy that calls siw_cq_flush\u2192siw_reap_cqe, so the OOB index is deterministic with no race or external precondition.\nPR:L - uverbs nodes are created mode 0666 with no capability check in ib_uverbs_open, and create_cq/mmap/destroy require no CAP_*; on systems with an existing siw device this is ordinary unprivileged local access (same model as other RDMA uverbs scores).\nUI:N - The attacker opens uverbs, creates and mmaps their own CQ, poisons CQEs, and destroys the CQ themselves; no separate victim action is required.\nS:U - Impact is confined to host-kernel memory access and crash within SoftiWARP/RDMA core on the same OS authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Malicious mmapped CQEs supply an unbounded __u16 status (and __u8 opcode) used as indexes into small static map_cqe_status/map_wc_opcode arrays, yielding a large attacker-chosen global out-of-bounds read; per guidance, OOB reads that are not strictly bounded are Confidentiality High.\nI:N - The defect only performs out-of-bounds loads from the mapping arrays into a local ib_wc; there is no OOB write, heap corruption, or control-flow hijack primitive in the vulnerable path.\nA:H - KASAN already reported global-out-of-bounds on this path, and a large status index reliably faults on unmapped kernel addresses during CQ flush/reap, producing a kernel oops/panic and full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:32.604Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6af043089d3f1210776d19b6fdabea610d4c7699"
        },
        {
          "url": "https://git.kernel.org/stable/c/75af03fdf35acf15a3977f7115f6b8d10dff4bc7"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6"
        },
        {
          "url": "https://git.kernel.org/stable/c/355d2eca68c10d713a42f68e62044b3d1c300471"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3d26a8589dfdeff328779b511f71fb90b10005e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdf1da5df9da680589a7f74448dd0a94dd3e1446"
        }
      ],
      "title": "RDMA/siw: Fix immediate work request flush to completion queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50736",
    "datePublished": "2025-12-24T12:22:54.695Z",
    "dateReserved": "2025-12-24T12:20:40.331Z",
    "dateUpdated": "2026-08-05T08:59:32.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50736",
      "date": "2026-09-14",
      "epss": "0.00187",
      "percentile": "0.08455"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50736\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:00.290\",\"lastModified\":\"2026-08-04T10:18:22.473\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/siw: Fix immediate work request flush to completion queue\\n\\nCorrectly set send queue element opcode during immediate work request\\nflushing in post sendqueue operation, if the QP is in ERROR state.\\nAn undefined ocode value results in out-of-bounds access to an array\\nfor mapping the opcode between siw internal and RDMA core representation\\nin work completion generation. It resulted in a KASAN BUG report\\nof type \u0027global-out-of-bounds\u0027 during NFSoRDMA testing.\\n\\nThis patch further fixes a potential case of a malicious user which may\\nwrite undefined values for completion queue elements status or opcode,\\nif the CQ is memory mapped to user land. It avoids the same out-of-bounds\\naccess to arrays for status and opcode mapping as described above.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_cq.c\",\"drivers/infiniband/sw/siw/siw_verbs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b\",\"lessThan\":\"6af043089d3f1210776d19b6fdabea610d4c7699\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b\",\"lessThan\":\"75af03fdf35acf15a3977f7115f6b8d10dff4bc7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b\",\"lessThan\":\"f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b\",\"lessThan\":\"355d2eca68c10d713a42f68e62044b3d1c300471\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b\",\"lessThan\":\"f3d26a8589dfdeff328779b511f71fb90b10005e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"303ae1cdfdf7280ff4cfbbe65563b5ff15bb025b\",\"lessThan\":\"bdf1da5df9da680589a7f74448dd0a94dd3e1446\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_cq.c\",\"drivers/infiniband/sw/siw/siw_verbs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.229\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.163\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.86\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.16\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.2\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/355d2eca68c10d713a42f68e62044b3d1c300471\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6af043089d3f1210776d19b6fdabea610d4c7699\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75af03fdf35acf15a3977f7115f6b8d10dff4bc7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bdf1da5df9da680589a7f74448dd0a94dd3e1446\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f3d26a8589dfdeff328779b511f71fb90b10005e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8d8fbd3b6d6cc3f25790cca5cffe8ded512fef6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T18:49:51+00:00",
      "cve": "CVE-2022-50736",
      "id": "CVE-2022-50736",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Privilege escalation via out-of-bounds write in RDMA/siw",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50736.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T02:19:12Z",
      "cve": "CVE-2022-50736",
      "id": "CVE-2022-50736",
      "initial_release_date": "2025-12-25T01:04:35Z",
      "product_status:known_affected": "420",
      "product_status:known_not_affected": "359",
      "product_status:recommended": "229",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50736",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50736.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.