CVE-2022-50736: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50736 is a vulnerability in the Linux kernel's RDMA/siw (Software iWARP) subsystem involving an out-of-bounds array access during immediate work request flushing to the completion queue. When a Queue Pair (QP) is in ERROR state, the send queue element opcode is not correctly set, resulting in an undefined opcode value that causes a global-out-of-bounds memory access when mapping opcodes between siw internal and RDMA core representations. The vulnerability was publicly disclosed on December 24, 2025, and affects Linux kernel versions from 5.3 through the fixed stable releases. The CVSS score is estimated as Medium by Feedly; no official CVSS score has been published at this time (Feedly, EUVD).

The root cause is an improper validation of array index values (CWE-129 / out-of-bounds read/write) in the RDMA/siw driver's post sendqueue operation. When the QP transitions to ERROR state and immediate work requests are flushed, the opcode field of the send queue element is left undefined; this undefined value is then used as an array index to map between siw-internal and RDMA core opcode/status representations, triggering a global-out-of-bounds access detected via KASAN during NFSoRDMA testing. Additionally, the vulnerability has a second attack surface: if the completion queue (CQ) is memory-mapped to user space, a malicious local user can write arbitrary undefined values for CQ element status or opcode fields, triggering the same out-of-bounds array access (Feedly). The fix was introduced starting at commit 303ae1cdfdf7 and backported to multiple stable branches (EUVD).

Exploitation of this vulnerability can result in kernel memory corruption due to out-of-bounds array access, potentially leading to a kernel panic (denial of service) or, in the user-space CQ mapping scenario, allowing a local unprivileged user to corrupt kernel memory structures. The primary impact is availability (system crash) and potentially integrity of kernel memory. The vulnerability is constrained to systems with RDMA/siw hardware or software iWARP configurations, such as those running NFSoRDMA workloads (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux 5.4.229, 5.10.163, 5.15.86, 6.0.16, and 6.1.2, as well as the 6.2 mainline release. Administrators should update to the appropriate patched stable kernel version for their distribution. SUSE has also issued advisories (SUSE-2026-0263, SUSE-2026-0317, SUSE-2026-0350, SUSE-2026-0411) incorporating these fixes. As a workaround, disabling or restricting access to RDMA/siw functionality and preventing user-space CQ memory mapping can reduce exposure until patching is feasible (Feedly, EUVD).