CVE-2022-50885: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50885 is a NULL pointer dereference vulnerability in the Linux kernel's RDMA/rxe (Soft RoCE) subsystem, specifically in the rxe_qp_do_cleanup() function. The flaw is triggered when socket creation fails in rxe_qp_init_req(), leaving a NULL pointer that is subsequently dereferenced during queue pair cleanup. It affects Linux kernel versions from 4.8 up through multiple stable branches, with patches available in versions 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. The vulnerability was published on December 30, 2025, and carries an estimated CVSS severity of Medium with an EPSS score of 0.000240 (Feedly, CVE.org).

The root cause is a NULL pointer dereference (CWE-476) in the rdma_rxe kernel module. When rxe_qp_init_req() fails to create a socket, the queue pair object is left in a partially initialized state with a NULL socket pointer. The cleanup function rxe_qp_do_cleanup() is then called without first checking for this NULL pointer, resulting in a kernel KASAN-detected read of 8 bytes at address 0x0000000000000018. The fix moves the rxe_qp_do_cleanup() reset logic to occur only after a NULL pointer check, preventing the invalid memory access. The vulnerability is reachable via the mount.cifs over RDMA code path (_smbd_get_connection → rdma_create_qp → rxe_create_qp) (Feedly).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, which can result in a kernel panic or system crash, impacting availability. The flaw is reachable by a local user with sufficient privileges to mount a CIFS share over RDMA, limiting the attack surface. There is no evidence of confidentiality or integrity impact beyond the denial-of-service condition caused by the kernel crash (Feedly).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution associated with CVE-2022-50885. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000240, reflecting minimal exploitation probability. The vulnerability requires local access and a specific RDMA/CIFS configuration to trigger (Feedly).

Apply the upstream kernel patches that introduce a NULL pointer check before calling rxe_qp_do_cleanup(). Fixed versions are available across multiple stable branches: 4.14.303, 4.19.270, 5.4.229, 5.10.163, 5.15.86, 6.0.16, 6.1.2, and 6.2. As a workaround, systems that do not use CIFS over RDMA (SMB Direct) can disable the rdma_rxe module to eliminate exposure. Users should update to a patched kernel version as soon as possible via their Linux distribution's update mechanism (Feedly, Kernel Patch 5.15).