CVE-2022-50736 RDMA/siw: Fix immediate work request flush to completion queue
A local attacker can trigger an out-of-bounds access in the Linux kernel RDMA subsystem, potentially causing a crash or executing arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-50736?
CVE-2022-50736 is a high-severity memory corruption vulnerability in Linux, published on 24 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix immediate work request flush to completion queue
Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERROR state. An undefined ocode value results in out-of-bounds access to an array for mapping the opcode between siw internal and RDMA core representation in work completion generation. It resulted in a KASAN BUG report of type 'global-out-of-bounds' during NFSoRDMA testing.
This patch further fixes a potential case of a malicious user which may write undefined values for completion queue elements status or opcode, if the CQ is memory mapped to user land. It avoids the same out-of-bounds access to arrays for status and opcode mapping as described above.
Which versions are affected by CVE-2022-50736?
How do I fix CVE-2022-50736?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-50736 being exploited?
There is no known exploitation of CVE-2022-50736 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2022-50736, GHSA-p4wh-wgxj-q3c5, UBUNTU-CVE-2022-50736.