CVE-2022-50822 (GCVE-0-2022-50822)
Vulnerability from cvelistv5
Published
2025-12-30 12:08
Modified
2026-08-05 08:59
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: Release MR restrack when delete The MR restrack also needs to be released when delete it, otherwise it cause memory leak as the task struct won't be released.
References
Impacted products
Vendor Product Version
Linux Linux Version: 13ef5539def732dc7b9c58c320d97a0a95b52634
Version: 13ef5539def732dc7b9c58c320d97a0a95b52634
Version: 13ef5539def732dc7b9c58c320d97a0a95b52634
Version: 13ef5539def732dc7b9c58c320d97a0a95b52634
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/restrack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13586753ae55146269a6dc8b216f17d86b81560c",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            },
            {
              "lessThan": "37c90753079fc95d93cc31b79796dd2ae57ad018",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            },
            {
              "lessThan": "8731cb5c7820bef577bab4ff17691fbf61c671cb",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            },
            {
              "lessThan": "dac153f2802db1ad46207283cb9b2aae3d707a45",
              "status": "affected",
              "version": "13ef5539def732dc7b9c58c320d97a0a95b52634",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/restrack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/restrack: Release MR restrack when delete\n\nThe MR restrack also needs to be released when delete it, otherwise it\ncause memory leak as the task struct won\u0027t be released."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via local InfiniBand uverbs MR deregistration (IB_USER_VERBS_CMD_DEREG_MR / UVERBS_METHOD_MR_DESTROY \u2192 uverbs_free_mr \u2192 ib_dereg_mr_user \u2192 rdma_restrack_del), not by processing remote network packets.\nAC:L - An attacker can reliably create and destroy MRs through uverbs, and can also drive the concurrent nldev RES_MR_GET path that holds a restrack reference; both sides of the race are attacker-controlled, so no external conditions are required.\nPR:L - uverbs device nodes are created mode 0666 with no capability check in ib_uverbs_open, and RDMA_NLDEV_CMD_RES_MR_GET does not require RDMA_NL_ADMIN_PERM, so an unprivileged local user on a system with an RDMA device (hardware or SoftRoCE) can trigger the bug.\nUI:N - Exploitation requires only the attacker\u0027s own uverbs and netlink operations; no action by another user is needed.\nS:U - Impact remains within the local kernel\u0027s authority (resource tracking / MR object lifetime); this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - Skipping wait_for_completion lets ib_dereg_mr_user free the MR while nldev still holds a restrack kref and fill_res_mr_entry reads MR fields, yielding a use-after-free that can be leveraged for arbitrary disclosure.\nI:H - The same use-after-free of the MR/restrack object enables heap reuse and corruption primitives sufficient for integrity compromise or control-flow hijacking under the highest-severity interpretation.\nA:H - The UAF can cause kernel oops/crash, and even without winning the race every MR delete leaks a task_struct reference via the skipped rdma_restrack_put, which can exhaust kernel memory through repeated create/destroy."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:47.720Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13586753ae55146269a6dc8b216f17d86b81560c"
        },
        {
          "url": "https://git.kernel.org/stable/c/37c90753079fc95d93cc31b79796dd2ae57ad018"
        },
        {
          "url": "https://git.kernel.org/stable/c/8731cb5c7820bef577bab4ff17691fbf61c671cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/dac153f2802db1ad46207283cb9b2aae3d707a45"
        }
      ],
      "title": "RDMA/restrack: Release MR restrack when delete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50822",
    "datePublished": "2025-12-30T12:08:36.228Z",
    "dateReserved": "2025-12-30T12:06:07.131Z",
    "dateUpdated": "2026-08-05T08:59:47.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.