CVE-2022-50666 RDMA/siw: Fix QP destroy to wait for all references dropped.
A use-after-free in the Linux kernel RDMA subsystem allows attackers to cause denial of service or execute code via delayed connection handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50666?
CVE-2022-50666 is a critical use after free vulnerability in Linux, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix QP destroy to wait for all references dropped.
Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
Which versions are affected by CVE-2022-50666?
How do I fix CVE-2022-50666?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2022-50666 being exploited?
There is no known exploitation of CVE-2022-50666 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50666, GHSA-mppj-wh3r-grwx, ROOT-OS-DEBIAN-11-CVE-2022-50666, UBUNTU-CVE-2022-50666.