Riskcovery

CVE-2022-50543

RDMA/rxe: Fix mr->map double free

State
Published
Severity
7.8 High
Published
Oct 7, 2025
Updated
Aug 5, 2026
Reserved
Oct 7, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix mr->map double free

rxe_mr_cleanup() which tries to free mr->map again will be called when rxe_mr_init_user() fails:

CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x5d panic+0x19e/0x349 end_report.part.0+0x54/0x7c kasan_report.cold+0xa/0xf rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe] __rxe_cleanup+0x10a/0x1e0 [rdma_rxe] rxe_reg_user_mr+0xb7/0xd0 [rdma_rxe] ib_uverbs_reg_mr+0x26a/0x480 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x1a2/0x250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1397/0x15a0 [ib_uverbs]

This issue was firstly exposed since commit b18c7da63fcb ("RDMA/rxe: Fix memory leak in error path code") and then we fixed it in commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()") but this fix was reverted together at last by commit 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs")

Simply let rxe_mr_cleanup() always handle freeing the mr->map once it is successfully allocated.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1e75550648da1fa1cd1969e7597355de8fe8caf6 to before 6ce577f09013206e36e674cd27da3707b2278268Affected
  • 1e75550648da1fa1cd1969e7597355de8fe8caf6 to before 06f73568f553b5be6ba7f6fe274d333ea29fc46dAffected
  • 1e75550648da1fa1cd1969e7597355de8fe8caf6 to before 7d984dac8f6bf4ebd3398af82b357e1d181ecaacAffected
  • e004a35e8148ad9fc438b0479884641acf382896Affected
  • 5.19.4 to before 5.20Affected
LinuxLinux
  • 6.0Affected
  • before 6.0Not affected
  • 6.0.16 through 6.0.*Not affected
  • 6.1.2 through 6.1.*Not affected
  • 6.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.