CVE-2022-50127: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50127 is a vulnerability in the Linux kernel's RDMA/rxe subsystem, discovered and disclosed on June 18, 2025. The vulnerability affects the rxecreateqp() function where spin locks are not properly initialized before potential error conditions (NVD).

The vulnerability exists in the rxecreateqp() function where rxeqpfrominit() is called to initialize qp. The spin locks are not set up until rxeqpinitreq() is called. If an error occurs before this initialization point, the unwind process calls rxecleanup() which eventually leads to rxeqpdocleanup()/rxecleanuptask(), resulting in an oops when attempting to access the uninitialized spinlock (NVD, Wiz).

When exploited, this vulnerability causes a system crash (oops) when attempting to access uninitialized spinlocks during the cleanup process (Wiz).

The vulnerability has been fixed by moving the spinlock initializations earlier in the code flow, before any potential failure points can occur. This ensures that the cleanup process always has properly initialized locks to work with. Various Linux distributions have released patches, including Ubuntu 20.04 LTS (5.4.0-132.148) and 18.04 LTS (4.15.0-197.208) (Ubuntu).