CVE-2022-50129 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2022-50129?

CVE-2022-50129 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's RDMA/srpt subsystem. An attacker could potentially exploit this to cause kernel memory corruption, leading to system crashes or arbitrary code execution with kernel privileges. Systems using RDMA (Remote Direct Memory Access) with the srpt driver are affected.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's RDMA/srpt subsystem. An attacker could potentially exploit this to cause kernel memory corruption, leading to system crashes or arbitrary code execution with kernel privileges. Systems using RDMA (Remote Direct Memory Access) with the srpt driver are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly listed, but references indicate stable kernel patches from 2022.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only systems with RDMA/srpt driver loaded and configured are vulnerable. Most standard Linux installations do not use this by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel privilege escalation leading to full system compromise, data exfiltration, or persistent backdoor installation.

🟠

Likely Case

System instability, kernel panics, or denial of service through targeted memory corruption.

🟢

If Mitigated

Limited impact if RDMA/srpt is not in use or proper access controls restrict attacker access.

🌐 Internet-Facing: LOW - RDMA typically requires local network access and specific configurations.

🏢 Internal Only: MEDIUM - Internal attackers with RDMA access could exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires RDMA access and knowledge of kernel memory layout. The KASAN report suggests it's triggered through configfs operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 388326bb1c32fcd09371c1d494af71471ef3a04b and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/388326bb1c32fcd09371c1d494af71471ef3a04b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable RDMA/srpt module

linux

Unload or blacklist the vulnerable kernel module if not required

sudo rmmod ib_srpt
echo 'blacklist ib_srpt' | sudo tee /etc/modprobe.d/blacklist-ib_srpt.conf

Restrict RDMA access

linux

Limit RDMA network access to trusted systems only

sudo firewall-cmd --permanent --zone=trusted --add-service=rdma
sudo firewall-cmd --reload

🧯 If You Can't Patch

Disable RDMA/srpt functionality entirely if not needed
Implement strict network segmentation to isolate RDMA traffic

🔍 How to Verify

Check if Vulnerable:

Check if ib_srpt module is loaded: lsmod | grep ib_srpt

Check Version:

uname -r

Verify Fix Applied:

Check kernel version against patched versions and verify ib_srpt module version

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN reports mentioning srpt
System crashes during RDMA operations

Network Indicators:

Unusual RDMA traffic patterns
Connection attempts to RDMA ports from untrusted sources

SIEM Query:

source="kernel" AND ("KASAN" OR "use-after-free" OR "srpt")

📊 Metadata

CVE ID: CVE-2022-50129

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (3.6th percentile)

Published: June 18, 2025

Last Updated: November 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-50129, you might also want to check these: