CVE-2022-50136: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50136 is a logic flaw in the Linux kernel's RDMA (Remote Direct Memory Access) siw (Software iWARP) component that causes a duplicated IW_CM_EVENT_CONNECT_REPLY event to be reported incorrectly. When siw_recv_mpa_rr returns -EAGAIN — indicating an incomplete MPA (Marker Protocol Authentication) reply — the code erroneously fires the connection reply event anyway, triggering a kernel BUG in drivers/infiniband/core/iwcm.c and causing system instability. The vulnerability affects Linux kernel versions 5.3–5.4.210, 5.5–5.10.136, 5.11–5.15.60, 5.16–5.18.17, and 5.19–5.19.1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a logic error (CWE-670: Always-Incorrect Control Flow Implementation) in the siw RDMA driver's MPA handshake handling. When siw_recv_mpa_rr returns -EAGAIN, it signals that the MPA reply has not yet been fully received; however, the driver incorrectly proceeds to report an IW_CM_EVENT_CONNECT_REPLY event to the iWARP Connection Manager (iw_cm). This duplicate event triggers an invalid opcode kernel BUG at iwcm.c:894 in the cm_work_handler workqueue, as the CM does not expect a second connect-reply event for the same connection. The issue can be reproduced locally using RDMA performance tools such as ib_send_lat between a server and client with the -R flag (Feedly, Kernel Patch).

Successful exploitation causes a kernel BUG (invalid opcode: 0000 [#1] PREEMPT SMP NOPTI) in the iw_cm workqueue, leading to system instability or a kernel panic (denial of service). There is no impact on confidentiality or integrity — the vulnerability is limited to availability (CVSS availability impact: High). Affected systems running RDMA-capable hardware with the siw driver loaded are at risk of unexpected crashes during RDMA connection establishment (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation. The vulnerability requires local access with low privileges to trigger via RDMA networking tools. The EPSS score is approximately 0.024% (0.000240), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries showing kernel BUG at drivers/infiniband/core/iwcm.c:894! with invalid opcode: 0000 [#1] PREEMPT SMP NOPTI.
• Logs: Call trace entries referencing cm_work_handler in the iw_cm_wq workqueue, followed by process_one_work, worker_thread, and kthread.
• Process: Unexpected termination or instability of processes relying on RDMA connections (e.g., MPI jobs, RDMA-based storage workloads) coinciding with the kernel trace.
• Network: RDMA connection attempts using ib_send_lat or similar tools with the -R (RDMA CM) flag that fail or cause system instability.

Apply the upstream kernel patches available for all affected stable branches: versions prior to 5.4.211, 5.10.137, 5.15.61, 5.18.18, and 5.19.2 should be updated to their respective fixed releases. Multiple patch commits are available in the stable kernel tree (Kernel Patch). As a workaround where patching is not immediately possible, restrict access to RDMA networking tools and limit local user access to RDMA devices, and monitor system logs for kernel traces related to iwcm. SUSE has also issued a security advisory (SUSE-2025-02308-1) addressing this and related kernel issues (Linux Security).

SUSE issued a kernel security update (SUSE-2025-02308-1) that includes a fix for CVE-2022-50136 among other kernel vulnerabilities (Linux Security). No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.