LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50138: RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()

In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() __qedr_alloc_mr() allocates a memory chunk for "mr->info.pbl_table" with init_mr_info(). When rdma_alloc_tid() and rdma_register_tid() fail, "mr" is released while "mr->info.pbl_table" is not released, which will lead to a memory leak. We should release the "mr->info.pbl_table" with qedr_free_pbl() when error occurs to fix the memory leak.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50138 is a Linux kernel memory leak in the RDMA/qedr driver. Under certain failure paths, allocated memory is not released. The business risk is likely availability-related, but the sources do not provide CVSS, exploitation evidence, or a clear remote/local attack path.

Executive priority

Treat as a targeted Linux kernel maintenance item, not an emergency based on current evidence. Prioritize patching on RDMA/qedr systems and high-availability hosts because the likely impact is resource exhaustion rather than confirmed code execution.

Technical view

In __qedr_alloc_mr(), mr->info.pbl_table is allocated by init_mr_info(). If rdma_alloc_tid() or rdma_register_tid() fails, mr is released without freeing the PBL table. Stable kernel commits add qedr_free_pbl() on the error path to prevent the leak.

Likely exposure

Exposure appears limited to Linux systems running affected kernel builds where the RDMA/qedr driver is present or used. The source bundle lists Linux as affected, but does not provide distribution-specific package names or complete deployment conditions.

Exploitation context

No CISA KEV listing or cited source indicates active exploitation. The disclosed issue is a memory leak triggered on specific RDMA/qedr allocation failure paths. Sources do not establish whether unprivileged users, remote actors, or only local/kernel-adjacent operations can trigger it.

Researcher notes

The public record lacks CVSS, CWE, exploitability analysis, and attacker prerequisites. Analysis should focus on the qedr memory-registration error path and whether operational configurations can cause repeated failures. Avoid assuming remote reachability without vendor or kernel evidence.

Mitigation direction

  • Check Linux distribution advisories for CVE-2022-50138 and affected kernel packages.
  • Update to a kernel containing the referenced stable commits.
  • Prioritize systems using RDMA/qedr-capable hardware or driver configurations.
  • If updates are delayed, follow vendor guidance for reducing qedr/RDMA exposure.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Identify systems with the qedr driver present, loaded, or required.
  • Confirm kernel changelogs include the CVE fix or referenced commits.
  • Monitor affected systems for abnormal kernel memory growth until remediated.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50138 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe0290cce6ac02f8e5ec501f25f6f6900f384550c, e0290cce6ac02f8e5ec501f25f6f6900f384550c, e0290cce6ac02f8e5ec501f25f6f6900f384550c, e0290cce6ac02f8e5ec501f25f6f6900f384550c, e0290cce6ac02f8e5ec501f25f6f6900f384550cunaffected
LinuxLinux4.9, 0, 5.10.137, 5.15.61, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.