LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50129: RDMA/srpt: Fix a use-after-free

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from regular members into pointers. Allocate the LIO port data structures from inside srpt_make_tport() and free these from inside srpt_make_tport(). Keep struct srpt_device as long as either an RDMA port or a LIO target port is associated with it. This patch decouples the lifetime of struct srpt_port (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO). This patch fixes the following KASAN complaint: BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt] Read of size 8 at addr ffff888141cc34b8 by task check/5093 Call Trace: <TASK> show_stack+0x4e/0x53 dump_stack_lvl+0x51/0x66 print_address_description.constprop.0.cold+0xea/0x41e print_report.cold+0x90/0x205 kasan_report+0xb9/0xf0 __asan_load8+0x69/0x90 srpt_enable_tpg+0x31/0x70 [ib_srpt] target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod] configfs_write_iter+0x18b/0x210 new_sync_write+0x1f2/0x2f0 vfs_write+0x3e3/0x540 ksys_write+0xbb/0x140 __x64_sys_write+0x42/0x50 do_syscall_64+0x34/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50129 is a Linux kernel use-after-free bug in the RDMA SRP target driver. It can cause unsafe memory access during storage target configuration. The public record does not provide CVSS, confirmed impact, or evidence of active exploitation.

Executive priority

Handle as a targeted infrastructure maintenance issue, not a broad emergency. Prioritize storage and RDMA environments first. Lack of CVSS and exploitation evidence lowers urgency, but kernel memory-safety flaws in storage paths warrant timely patch validation.

Technical view

The fix changes srpt_port LIO port members into separately allocated pointers and decouples lifetimes between RDMA-managed srpt_port and LIO-managed srpt_port_id. The KASAN trace shows use-after-free in srpt_enable_tpg through the target/configfs enable path for ib_srpt.

Likely exposure

Most relevant to Linux systems using RDMA and the ib_srpt SCSI RDMA Protocol target with LIO target configuration. General Linux servers not using this kernel module or target functionality are less likely exposed. Confirm exact exposure through distribution kernel advisories.

Exploitation context

The source bundle does not cite KEV listing, public exploitation, or exploit availability. The trace indicates a configuration path involving configfs and target portal group enablement, but the sources do not establish remote exploitability or required privileges.

Researcher notes

Evidence is limited to the Linux CVE record and stable kernel commits. No CWE, CVSS, exploit status, or distro-specific package mapping is provided in the bundle. Treat affected-version interpretation cautiously and rely on downstream vendor advisories for operational decisions.

Mitigation direction

  • Check Linux distribution advisories for CVE-2022-50129 status and fixed kernel packages.
  • Update affected kernels to vendor-provided fixed versions when available.
  • If not needed, avoid loading or using the ib_srpt RDMA target functionality.
  • Prioritize systems providing RDMA-backed storage target services.

Validation and detection

  • Inventory Linux kernels and identify systems using RDMA SRP target functionality.
  • Check whether ib_srpt is present, loaded, or configured on storage hosts.
  • Compare running kernel builds with vendor advisories and referenced stable commits.
  • After updating, verify the host runs the fixed kernel package.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50129 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa42d985bd5b234da8b61347a78dc3057bf7bb94d, a42d985bd5b234da8b61347a78dc3057bf7bb94d, a42d985bd5b234da8b61347a78dc3057bf7bb94d, a42d985bd5b234da8b61347a78dc3057bf7bb94d, a42d985bd5b234da8b61347a78dc3057bf7bb94dunaffected
LinuxLinux3.3, 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.