CVE-2022-48725

What it actually does

Missing atomic_dec() on the error path after atomic_inc() in siw_create_qp() causes a reference count leak on the affected RDMA queue pair object.

Why it matters to the business

Repeated triggering of the error path in RDMA/siw queue pair creation can exhaust kernel resources on systems using the siw driver, potentially leading to degraded performance or denial of service in RDMA-enabled environments.

How an attack unfolds

An attacker with local access crafts inputs that cause siw_create_qp() to take the error path, repeatedly leaking references without corresponding decrements and gradually exhausting kernel object accounting.

How to fix it

Upgrade the Linux kernel to a version containing commit 2989ba9532babac66e79997ccff73c015b69700c or later; apply the stable backport that pairs the atomic_inc() with a corresponding atomic_dec() on the error path.

How to confirm the fix worked

Verify the presence of the fixing commit in the running kernel source tree and confirm that siw_create_qp() now executes atomic_dec() on all error paths; test by exercising the error path and checking that reference counts return to their prior values.

Typical attack path

1. Identify systems exposing RDMA/siw interfaces or allowing unprivileged RDMA operations.
2. Trigger siw_create_qp() with parameters that force an error after the atomic_inc().
3. Repeat the operation to accumulate leaked references.
4. Monitor for resource exhaustion or attempt to leverage the leak for further kernel memory manipulation.

How to detect it

Review kernel logs for repeated siw_create_qp error paths; inspect reference count accounting around RDMA queue pair creation in crash dumps or live debugging; look for unusual growth in siw-related object counts.

What your security team should do

• Prioritize patching kernels that include the siw RDMA driver, especially in environments with RDMA workloads.
• Restrict unprivileged access to RDMA interfaces until the fix is deployed.
• Monitor for resource exhaustion symptoms on systems using siw.