CVE-2022-50671: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50671 is a NULL pointer dereference vulnerability in the Linux kernel's RDMA/rxe (Soft RoCE) subsystem. The flaw occurs when rxe_queue_init fails inside rxe_qp_init_req, leaving qp->req.task.func and qp->req.task.arg uninitialized; the subsequent cleanup path in rxe_create_qp calls __rxe_do_task without checking these pointers, triggering a kernel NULL pointer dereference. The vulnerability was formally published on December 9, 2025, and affects Linux kernel versions from approximately 4.8 through the unpatched stable branches, with fixes backported to versions 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. The CVSS estimate is Medium severity (Feedly, ENISA EUVD).

The root cause is a missing null check (CWE-476: NULL Pointer Dereference) in the RDMA/rxe queue pair (QP) initialization error-handling path. When rxe_queue_init fails during rxe_qp_init_req, the task function pointer (qp->req.task.func) and argument (qp->req.task.arg) remain uninitialized (NULL). The cleanup function rxe_qp_do_cleanup, invoked on QP creation failure, subsequently calls __rxe_do_task without validating these pointers, causing a kernel NULL pointer dereference. The fix adds null checks for both qp->req.task.func and qp->req.task.arg before invoking __rxe_do_task (Feedly, Kernel Patch).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic (system crash) and denial of service on the affected host. The vulnerability is local in nature, requiring an attacker to have the ability to trigger RDMA/rxe QP creation with conditions that cause rxe_queue_init to fail. There is no evidence of confidentiality or integrity impact beyond the availability disruption caused by the kernel crash (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2022-50671. The EPSS score is approximately 0.033% (0.000330), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection signatures exist in Nessus (plugin 277964, 302405) and Qualys (IDs 760731, 677637, 677618) (Feedly, Tenable).

Apply the upstream kernel patches that add null checks for qp->req.task.func and qp->req.task.arg before calling __rxe_do_task. Fixed versions include Linux kernel stable releases: 4.9.331, 4.14.296, 4.19.262, 5.4.220, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1. SUSE Linux Enterprise users should apply the vendor-provided kernel updates (e.g., SUSE advisories SUSE-2026-0263-1, SUSE-2026-0317-1, SUSE-2026-0350-1, SUSE-2026-0411-1). As a workaround where patching is not immediately possible, disabling the rdma_rxe kernel module (if not required) will eliminate the attack surface (Feedly, Linux Security).

Coverage has been limited to routine security advisory channels. SUSE issued multiple kernel update advisories referencing this CVE, and Tenable published Nessus detection plugins. No notable researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (Linux Security, Tenable).