CVE-2022-49925

RDMA/core: Fix null-ptr-deref in ib_core_cleanup()

State: Published
Severity: 5.5 Medium
Published: May 1, 2025
Updated: May 11, 2026
Reserved: May 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Fix null-ptr-deref in ib_core_cleanup()

KASAN reported a null-ptr-deref error:

KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 1 PID: 379 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:destroy_workqueue+0x2f/0x740 RSP: 0018:ffff888016137df8 EFLAGS: 00000202 ... Call Trace: ib_core_cleanup+0xa/0xa1 [ib_core] __do_sys_delete_module.constprop.0+0x34f/0x5b0 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa1a0d221b7 ...

It is because the fail of roce_gid_mgmt_init() is ignored:

ib_core_init() roce_gid_mgmt_init() gid_cache_wq = alloc_ordered_workqueue # fail ... ib_core_cleanup() roce_gid_mgmt_cleanup() destroy_workqueue(gid_cache_wq) # destroy an unallocated wq

Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init().

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before af8fb5a0600e9ae29950e9422a032c3c22649ee5Affected 03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before d360e875c011a005628525bf290322058927e7dcAffected 03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before 6b3d5dcb12347f3518308c2c9d2cf72453a3e1e5Affected 03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before ab817f75e5e0fa58d9be0825da6a7b7d8a1fa1d9Affected 03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before 07c0d131cc0fe1f3981a42958fc52d573d303d89Affected
LinuxLinux	4.3Affected before 4.3Not affected 5.4.224 through 5.4.Not affected 5.10.154 through 5.10.Not affected 5.15.78 through 5.15.Not affected 6.0.8 through 6.0.Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before af8fb5a0600e9ae29950e9422a032c3c22649ee5Affected
03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before d360e875c011a005628525bf290322058927e7dcAffected
03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before 6b3d5dcb12347f3518308c2c9d2cf72453a3e1e5Affected
03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before ab817f75e5e0fa58d9be0825da6a7b7d8a1fa1d9Affected
03db3a2d81e6e84f3ed3cb9e087cae17d762642b to before 07c0d131cc0fe1f3981a42958fc52d573d303d89Affected

LinuxLinux

4.3Affected
before 4.3Not affected
5.4.224 through 5.4.*Not affected
5.10.154 through 5.10.*Not affected
5.15.78 through 5.15.*Not affected
6.0.8 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.