GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50822 (GCVE-0-2022-50822)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:08 – Updated: 2026-08-05 08:59
VLAI
Title
RDMA/restrack: Release MR restrack when delete
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: Release MR restrack when delete The MR restrack also needs to be released when delete it, otherwise it cause memory leak as the task struct won't be released.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 13ef5539def732dc7b9c58c320d97a0a95b52634 , < 13586753ae55146269a6dc8b216f17d86b81560c (git)
Affected: 13ef5539def732dc7b9c58c320d97a0a95b52634 , < 37c90753079fc95d93cc31b79796dd2ae57ad018 (git)
Affected: 13ef5539def732dc7b9c58c320d97a0a95b52634 , < 8731cb5c7820bef577bab4ff17691fbf61c671cb (git)
Affected: 13ef5539def732dc7b9c58c320d97a0a95b52634 , < dac153f2802db1ad46207283cb9b2aae3d707a45 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/restrack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13586753ae55146269a6dc8b216f17d86b81560c",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            },
            {
              "lessThan": "37c90753079fc95d93cc31b79796dd2ae57ad018",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            },
            {
              "lessThan": "8731cb5c7820bef577bab4ff17691fbf61c671cb",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            },
            {
              "lessThan": "dac153f2802db1ad46207283cb9b2aae3d707a45",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/restrack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/restrack: Release MR restrack when delete\n\nThe MR restrack also needs to be released when delete it, otherwise it\ncause memory leak as the task struct won\u0027t be released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via local InfiniBand uverbs MR deregistration (IB_USER_VERBS_CMD_DEREG_MR / UVERBS_METHOD_MR_DESTROY \u2192 uverbs_free_mr \u2192 ib_dereg_mr_user \u2192 rdma_restrack_del), not by processing remote network packets.\nAC:L - An attacker can reliably create and destroy MRs through uverbs, and can also drive the concurrent nldev RES_MR_GET path that holds a restrack reference; both sides of the race are attacker-controlled, so no external conditions are required.\nPR:L - uverbs device nodes are created mode 0666 with no capability check in ib_uverbs_open, and RDMA_NLDEV_CMD_RES_MR_GET does not require RDMA_NL_ADMIN_PERM, so an unprivileged local user on a system with an RDMA device (hardware or SoftRoCE) can trigger the bug.\nUI:N - Exploitation requires only the attacker\u0027s own uverbs and netlink operations; no action by another user is needed.\nS:U - Impact remains within the local kernel\u0027s authority (resource tracking / MR object lifetime); this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - Skipping wait_for_completion lets ib_dereg_mr_user free the MR while nldev still holds a restrack kref and fill_res_mr_entry reads MR fields, yielding a use-after-free that can be leveraged for arbitrary disclosure.\nI:H - The same use-after-free of the MR/restrack object enables heap reuse and corruption primitives sufficient for integrity compromise or control-flow hijacking under the highest-severity interpretation.\nA:H - The UAF can cause kernel oops/crash, and even without winning the race every MR delete leaks a task_struct reference via the skipped rdma_restrack_put, which can exhaust kernel memory through repeated create/destroy."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:47.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13586753ae55146269a6dc8b216f17d86b81560c"
        },
        {
          "url": "https://git.kernel.org/stable/c/37c90753079fc95d93cc31b79796dd2ae57ad018"
        },
        {
          "url": "https://git.kernel.org/stable/c/8731cb5c7820bef577bab4ff17691fbf61c671cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/dac153f2802db1ad46207283cb9b2aae3d707a45"
        }
      ],
      "title": "RDMA/restrack: Release MR restrack when delete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50822",
    "datePublished": "2025-12-30T12:08:36.228Z",
    "dateReserved": "2025-12-30T12:06:07.131Z",
    "dateUpdated": "2026-08-05T08:59:47.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50822",
      "date": "2026-09-15",
      "epss": "0.0019",
      "percentile": "0.0879"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50822\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:15:56.637\",\"lastModified\":\"2026-08-04T10:18:24.320\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/restrack: Release MR restrack when delete\\n\\nThe MR restrack also needs to be released when delete it, otherwise it\\ncause memory leak as the task struct won\u0027t be released.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/core/restrack.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"13ef5539def732dc7b9c58c320d97a0a95b52634\",\"lessThan\":\"13586753ae55146269a6dc8b216f17d86b81560c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ef5539def732dc7b9c58c320d97a0a95b52634\",\"lessThan\":\"37c90753079fc95d93cc31b79796dd2ae57ad018\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ef5539def732dc7b9c58c320d97a0a95b52634\",\"lessThan\":\"8731cb5c7820bef577bab4ff17691fbf61c671cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"13ef5539def732dc7b9c58c320d97a0a95b52634\",\"lessThan\":\"dac153f2802db1ad46207283cb9b2aae3d707a45\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/core/restrack.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.86\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.16\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.2\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/13586753ae55146269a6dc8b216f17d86b81560c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37c90753079fc95d93cc31b79796dd2ae57ad018\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8731cb5c7820bef577bab4ff17691fbf61c671cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dac153f2802db1ad46207283cb9b2aae3d707a45\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:37:12+00:00",
      "cve": "CVE-2022-50822",
      "id": "CVE-2022-50822",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "240",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Memory leak in RDMA restrack leads to Denial of Service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50822.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T01:59:26Z",
      "cve": "CVE-2022-50822",
      "id": "CVE-2022-50822",
      "initial_release_date": "2025-12-31T00:31:58Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "432",
      "product_status:recommended": "245",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50822",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50822.json",
      "version": "27"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.