CVE-2022-50666
A critical flaw in the Linux kernel’s RDMA/siw module can cause a use‑after‑free crash when a Queue Pair is destroyed while still referenced. The bug could lead to a denial‑of‑service or, in some scenarios, arbitrary code execution. It has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running a version that contains the vulnerable RDMA/siw implementation, typically servers or devices that use RDMA over InfiniBand or iWARP. The issue is present in any kernel version before the patch.
Real-world impact
An attacker could trigger a crash or potentially execute code by exploiting the use‑after‑free in the RDMA/siw component, resulting in denial of service or privilege escalation.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability can be exploited remotely without authentication or user interaction, has a low complexity, and would fully compromise confidentiality, integrity, and availability.
What to do about it
- 01Update your Linux kernel to a version that includes the fix for CVE-2022-50666.
NVD-referenced vendor advisory
Timeline
- Dec 9, 2025 · Dec 9, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 1d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 1d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.