CVE-2022-50885

What it actually does

Null pointer dereference in rxe_qp_do_cleanup() triggered when socket creation fails inside rxe_qp_init_req() during RDMA QP setup.

Why it matters to the business

Kernel panic or crash can occur on systems attempting CIFS mounts over RDMA, causing unexpected downtime and loss of availability for storage-dependent workloads.

How an attack unfolds

An attacker or legitimate user initiates a CIFS mount over RDMA; when the underlying socket creation fails in rxe_qp_init_req(), the subsequent cleanup path dereferences a null pointer, crashing the kernel.

How to fix it

Apply the upstream fix in commit ee24de095569935eba600f7735e8e8ddea5b418e or later; update to a kernel containing this commit and rebuild any out-of-tree RDMA modules.

How to confirm the fix worked

Confirm the presence of commit ee24de095569935eba600f7735e8e8ddea5b418e in the kernel source tree or verify the patched rxe_qp_do_cleanup() function contains the null check before the reset logic.

Typical attack path

1. Initiate mount.cifs with RDMA transport
2. Trigger failure during socket creation in rxe_qp_init_req()
3. Invoke rxe_qp_do_cleanup() without proper null check
4. Kernel dereferences null pointer leading to panic

How to detect it

Search kernel logs for KASAN null-ptr-deref reports in rxe_qp_do_cleanup and call traces containing mount.cifs and rdma_rxe; examine dmesg or syslog for the exact BUG pattern shown in the advisory.

• BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup
• rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe]
• mount.cifs.*rdma_rxe

What your security team should do

• Prioritize kernel update containing ee24de095569935eba600f7735e8e8ddea5b418e on all systems using RDMA and CIFS
• Restrict RDMA interfaces to trusted networks until patched
• Monitor for kernel oops involving rdma_rxe during mount operations