Read the docs
TI-2022-26017 Aliases CVE-2022-50543GHSA-rjw2-5698-2f3h

RDMA/rxe: Fix mr->map double free

Priority LOW 35CWE-415Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-415 and the CVSS impact.

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr->map double free rxe_mr_cleanup() which tries to free mr->map again will be called when rxe_mr_init_user() fails: CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x5d panic+0x19e/0x349 end_report.part.0+0x54/0x7c kasan_report.cold+0xa/0xf rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe] __rxe_cleanup+0x10a/0x1e0 [rdma_rxe] rxe_reg_user_mr+0xb7/0xd0 [rdma_rxe] ib_uverbs_reg_mr+0x26a/0x480 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x1a2/0x250 [ib_uverbs] ib_uverbs_cmd_verbs+0x1397/0x15a0 [ib_uverbs] This issue was firstly exposed since commit b18c7da63fcb ("RDMA/rxe: Fix memory leak in error path code") and then we fixed it in commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()") but this fix was reverted together at last by commit 1e75550648da (Revert "RDMA/rxe: Create duplicate mapping tables for FMRs") Simply let rxe_mr_cleanup() always handle freeing the mr->map once it is successfully allocated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00167 6th percentileScored 2026-11-07
Fix Partial Linux (Linux): 5.20, 6.0.16, 6.1.2 +1Red Hat: 6 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux5.19.4 to before 5.205.20Patch availableCNA
LinuxLinux6.0 and later6.0.16, 6.1.2, 6.2Patch availableCNA
  • Linux VendorLinux Affected 5.19.4 to before 5.20 Fixed in 5.20 Patch available CNA
  • Linux VendorLinux Affected 6.0 and later Fixed in 6.0.16, 6.1.2, 6.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*5.19.4 to before 6.0.16; 6.1 to before 6.1.2VulnerableLinux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions 5.19.4 to before 6.0.16; 6.1 to before 6.1.2 Vulnerable ·Linux

Remediation

  • Fix · CNA Linux (Linux) Fixed in 5.20
  • Fix · CNA Linux (Linux) Fixed in 6.0.16, 6.1.2, 6.2

Red Hat 6 advisories

  • RHSA-2026:0536 Released 2026-01-14 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) bpftool-4.18.0-372.175.1.el8_6, kernel-4.18.0-372.175.1.el8_6, kernel-abi-stablelists-4.18.0-372.175.1.el8_6 +14
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) bpftool-4.18.0-372.175.1.el8_6, kernel-4.18.0-372.175.1.el8_6, kernel-abi-stablelists-4.18.0-372.175.1.el8_6 +19
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) bpftool-4.18.0-372.175.1.el8_6, kernel-4.18.0-372.175.1.el8_6, kernel-abi-stablelists-4.18.0-372.175.1.el8_6 +14
  • RHSA-2026:0532 Released 2026-01-14 · Red Hat rating Important
    kernel security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) bpftool-4.18.0-477.124.1.el8_8, kernel-4.18.0-477.124.1.el8_8, kernel-abi-stablelists-4.18.0-477.124.1.el8_8 +14
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) bpftool-4.18.0-477.124.1.el8_8, kernel-4.18.0-477.124.1.el8_8, kernel-abi-stablelists-4.18.0-477.124.1.el8_8 +14
  • RHSA-2025:22801 Released 2025-12-08 · Red Hat rating Moderate
    kernel security update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-553.89.1.el8_10, kernel-4.18.0-553.89.1.el8_10, kernel-abi-stablelists-4.18.0-553.89.1.el8_10 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-553.89.1.el8_10
Show 3 more Red Hat advisories
  • RHSA-2025:22800 Released 2025-12-08 · Red Hat rating Moderate
    kernel-rt security update
    • Red Hat Enterprise Linux NFV (v. 8) kernel-rt-4.18.0-553.89.1.rt7.430.el8_10, kernel-rt-core-4.18.0-553.89.1.rt7.430.el8_10, kernel-rt-debug-4.18.0-553.89.1.rt7.430.el8_10 +9
    • Red Hat Enterprise Linux RT (v. 8) kernel-rt-4.18.0-553.89.1.rt7.430.el8_10, kernel-rt-core-4.18.0-553.89.1.rt7.430.el8_10, kernel-rt-debug-4.18.0-553.89.1.rt7.430.el8_10 +7
  • RHSA-2023:6583 Released 2023-11-07 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 9) kernel-tools-libs-devel-5.14.0-362.8.1.el9_3, libperf-5.14.0-362.8.1.el9_3
    • Red Hat Enterprise Linux AppStream (v. 9) kernel-64k-debug-devel-5.14.0-362.8.1.el9_3, kernel-64k-debug-devel-matched-5.14.0-362.8.1.el9_3, kernel-64k-devel-5.14.0-362.8.1.el9_3 +11
    • Red Hat Enterprise Linux BaseOS (v. 9) bpftool-7.2.0-362.8.1.el9_3, kernel-5.14.0-362.8.1.el9_3, kernel-64k-5.14.0-362.8.1.el9_3 +29
    • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +9
    • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt-5.14.0-362.8.1.el9_3, kernel-rt-core-5.14.0-362.8.1.el9_3, kernel-rt-debug-5.14.0-362.8.1.el9_3 +11
  • RHSA-2023:2951 Released 2023-05-16 · Red Hat rating Important
    kernel security, bug fix, and enhancement update
    • Red Hat Enterprise Linux BaseOS (v. 8) bpftool-4.18.0-477.10.1.el8_8, kernel-4.18.0-477.10.1.el8_8, kernel-abi-stablelists-4.18.0-477.10.1.el8_8 +19
    • Red Hat Enterprise Linux CRB (v. 8) kernel-tools-libs-devel-4.18.0-477.10.1.el8_8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2023:2951, RHSA-2025:22801
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:0536
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:0536
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:0532
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:0536
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:0532
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2023:2951, RHSA-2025:22801
Red Hat Enterprise Linux NFV (v. 8)Fixed RHSA-2025:22800
Red Hat Enterprise Linux RT (v. 8)Fixed RHSA-2025:22800
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50543
  2. 2026-10-03 Alias added: GHSA-rjw2-5698-2f3h

References

Patch 3

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
  • TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
See all 15278 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences