Executive brief
The Linux kernel's RDMA/rxe driver contains a memory management defect in its user-space memory registration code. When memory registration fails, a cleanup function attempts to free memory buffers that were already freed earlier in the error handling path, causing a kernel panic. This can be exploited by unprivileged local users to crash the system or potentially achieve code execution with kernel privileges.
Technical details
The vulnerability is a use-after-free / double-free in the RDMA/rxe driver's memory region (mr) handling. The root cause lies in the error path of rxe_mr_init_user(): when memory allocation or initialization fails, the function's cleanup code attempts to free mr->map structures, which were already freed by a previous error handler. This triggers a KASAN (Kernel Address Sanitizer) panic. The vulnerable code path is reachable by any user with RDMA device access (typically via ib_uverbs), requiring no special privileges. The fix ensures mr->map is only freed once by setting it to NULL after freeing and consolidating error handling paths. Patches are available in upstream Linux kernel commits 7d984dac8f6bf4ebd3398af82b357e1d181ecaac and later stable releases.
Affected products
- Linux Linux Kernel before 6.1 (affected versions include 5.x and 6.0.x; patched in 6.1+)
Timeline
- 2022-10-30: disclosed: Vulnerability report by Li Zhijian
- 2022-12-31: patched: Fix merged in Linux stable trees
- 2025-10-07: advisory: CVE-2022-50543 published