CVE-2022-50775 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix refcount leak in hns_roce_mmap
rdma_user_mmap_entry_get_pgoff() takes the reference. Add missing rdma_user_mmap_entry_put() to release the reference.
Acked-by Haoyue Xu <[email protected]>
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/22/2026
The vulnerability identified as CVE-2022-50775 represents a critical reference counting issue within the Linux kernel's RDMA subsystem, specifically affecting the hns (Huawei Networking Solutions) driver implementation. This flaw resides in the memory mapping functionality where the kernel fails to properly release references to memory mapping entries, creating a resource management gap that can lead to system instability and potential security implications. The issue occurs within the hns_roce_mmap function which handles memory mapping operations for RDMA (Remote Direct Memory Access) hardware components, particularly those manufactured by Huawei.
The technical root cause of this vulnerability stems from improper reference counting management within the kernel's memory mapping subsystem. When rdma_user_mmap_entry_get_pgoff() function is invoked, it increments the reference count to track active memory mapping entries, however the corresponding rdma_user_mmap_entry_put() function is never called to decrement this count and release the reference. This creates a memory leak scenario where reference counts remain elevated indefinitely, preventing proper cleanup of memory mapping resources. The vulnerability manifests as a reference count leak that can accumulate over time, leading to resource exhaustion and potential system crashes.
The operational impact of this vulnerability extends beyond simple memory consumption issues, as it can compromise system stability and availability. When reference counts are not properly managed, the kernel's memory management subsystem becomes increasingly burdened with unreleased resources, potentially leading to denial of service conditions where legitimate memory allocation requests cannot be fulfilled. The vulnerability affects systems utilizing Huawei's RDMA hardware components through the hns driver, particularly those implementing memory mapping operations for high-performance computing or data center networking environments. This can result in system slowdowns, application failures, or complete system crashes depending on the severity and duration of the resource leak.
Security implications of this reference count leak align with CWE-404, which addresses improper resource release or cleanup, and can be categorized under ATT&CK technique T1499.1 for resource exhaustion attacks. The vulnerability creates an opportunity for adversaries to exploit resource management flaws and potentially cause system instability or denial of service conditions. While the direct security impact may be limited compared to other vulnerability types, the resource exhaustion potential makes it a significant concern for production systems where stability and availability are paramount. The issue is particularly concerning in high-performance computing environments where RDMA operations are frequently utilized and memory mapping is critical for performance optimization.
Mitigation strategies should focus on applying the kernel patch that properly implements the missing rdma_user_mmap_entry_put() function call to ensure reference counting integrity. System administrators should prioritize updating to kernel versions containing the fix, particularly in production environments utilizing Huawei RDMA hardware components. Monitoring for memory consumption patterns and resource utilization should be implemented to detect potential impacts of the leak before they escalate to system instability. Additionally, organizations should conduct regular security assessments of their kernel configurations and ensure proper patch management procedures are in place to address similar reference counting issues that may exist in other kernel subsystems. The fix demonstrates proper adherence to kernel memory management best practices and follows established patterns for reference counting in kernel space operations.