CVE-2022-50885 in Linux
Summary
by MITRE • 12/30/2025
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
There is a null-ptr-deref when mount.cifs over rdma:
BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
Read of size 8 at addr 0000000000000018 by task mount.cifs/3046
CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xad/0x130 rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
execute_in_process_context+0x25/0x90 __rxe_cleanup+0x101/0x1d0 [rdma_rxe]
rxe_create_qp+0x16a/0x180 [rdma_rxe]
create_qp.part.0+0x27d/0x340 ib_create_qp_kernel+0x73/0x160 rdma_create_qp+0x100/0x230 _smbd_get_connection+0x752/0x20f0 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
The root cause of the issue is the socket create failed in rxe_qp_init_req().
So move the reset rxe_qp_do_cleanup() after the NULL ptr check.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/26/2026
The vulnerability CVE-2022-50885 represents a critical null pointer dereference in the Linux kernel's RDMA over Ethernet (rxe) driver implementation. This flaw manifests specifically when the mount.cifs utility attempts to establish RDMA connections for SMB file sharing operations. The issue occurs during the cleanup phase of queue pair creation when socket creation fails, leading to a kernel panic scenario that can compromise system stability and availability. The vulnerability is classified under CWE-476 as a null pointer dereference, which represents a fundamental memory safety issue that can be exploited to cause system crashes or potentially enable privilege escalation attacks.
The technical root cause lies within the rxe_qp_do_cleanup() function where the driver attempts to access a null pointer at address 0x0000000000000018 during the cleanup process. This memory address offset suggests the driver is trying to dereference a field within a queue pair structure that was never properly initialized due to a failed socket creation operation in rxe_qp_init_req(). The kernel stack trace reveals that the execution path flows through the mount.cifs process, which triggers the RDMA connection establishment sequence, ultimately leading to the kernel memory access violation. This pattern aligns with ATT&CK technique T1068 which involves exploiting local system privileges to gain code execution through kernel vulnerabilities.
The operational impact of this vulnerability extends beyond simple system crashes as it affects enterprise network infrastructure where SMB file sharing over RDMA is commonly deployed. When exploited, the null pointer dereference can cause complete system hangs or reboots, disrupting critical file services and potentially allowing denial of service attacks against networked applications. The vulnerability is particularly concerning in high-availability environments where such crashes could lead to service interruptions and data access failures. The specific failure scenario occurs during the SMBD (SMB Direct) connection establishment process, which is designed to improve performance by using RDMA for direct memory access operations.
Mitigation strategies for CVE-2022-50885 should focus on immediate kernel updates to patched versions that properly handle the null pointer condition in the cleanup routine. System administrators should prioritize applying security patches from their respective Linux distributions, as the fix involves moving the cleanup function execution after the null pointer validation check in the rxe driver code. Additionally, monitoring for kernel oops messages and system crashes related to RDMA operations should be implemented to detect potential exploitation attempts. Organizations using RDMA-enabled SMB services should consider temporarily disabling RDMA functionality for SMB connections until proper patches are deployed, as recommended in the NIST cybersecurity framework for managing known vulnerabilities. The fix demonstrates proper defensive programming practices by ensuring null pointer validation occurs before memory access operations, aligning with security best practices outlined in the OWASP Secure Coding Standards.