CVE-2022-50726: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50726 is a use-after-free vulnerability in the Linux kernel's net/mlx5 (Mellanox ConnectX) async command interface. The flaw exists in mlx5_cmd_cleanup_async_ctx, which could return before all in-flight callback handlers completed, allowing a subsequent wake_up() call on a freed mlx5_async_ctx object. It affects the Linux kernel and was published on December 24, 2025. Feedly estimates the severity as HIGH, and the EPSS score is approximately 0.018% (very low probability of exploitation) (Feedly).

The root cause is a race condition (CWE-416: Use After Free) between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler in the Linux kernel's MLX5 network driver. The race occurs when mlx5_cmd_cleanup_async_ctx decrements num_inflight and calls wait_event, which returns immediately because num_inflight reaches 0 — but the callback handler has not yet finished executing wake_up(). After the cleanup function returns and the caller frees the mlx5_async_ctx object, the callback handler calls wake_up() on the now-freed memory, triggering a use-after-free. The fix synchronizes cleanup using a completion object that is marked complete only when num_inflight reaches 0, ensuring the cleanup function waits for all callbacks to fully finish (Feedly, Kernel Git).

Successful exploitation of this use-after-free can lead to kernel memory corruption, potentially causing a system crash (denial of service) or, in more severe scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is confined to systems using Mellanox/NVIDIA ConnectX network adapters with the mlx5 driver loaded. The KASAN trace confirms a read of freed memory in do_raw_spin_lock, indicating the immediate impact is kernel instability or crash (Feedly).

Apply the upstream Linux kernel patches that fix the race condition by replacing the flawed synchronization logic with a completion object. The fix is available in multiple stable kernel branches via commits 0aa3ee1e4e5c, 69dd3ad406c4, ab3de780c176, bacd22df9514, and bbcc06933f35 (Kernel Git). SUSE has issued kernel security advisories (SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0350, SUSE-2026-0411) addressing this CVE; users of affected distributions should apply the latest vendor-provided kernel updates (Linux Security). As a workaround where patching is not immediately possible, unloading the mlx5_core kernel module (if the hardware is not in active use) can eliminate exposure, though this is not practical in production environments relying on Mellanox NICs.