---
id: CVE-2022-49929
title: 'RDMA/rxe: Fix mr leak in RESPST_ERR_RNR'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/rxe: Fix mr leak in RESPST_ERR_RNR

  rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr)
  to drop mr's ref_cnt in RESPST_ERR_RNR to avoid belo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8a1a0be894da0d06bfbb496cc2dc3057fa83e103 <
    50b35ad2864a9d66f802f9ce193d99bbef64e219
  - >-
    Linux >= 8a1a0be894da0d06bfbb496cc2dc3057fa83e103 <
    b5f9a01fae42684648c2ee3cd9985f80c67ab9f7
  - Linux 5.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:51:34.230714Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:11.641Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49929'
references:
  - url: 'https://git.kernel.org/stable/c/50b35ad2864a9d66f802f9ce193d99bbef64e219'
  - url: 'https://git.kernel.org/stable/c/b5f9a01fae42684648c2ee3cd9985f80c67ab9f7'
tags:
  - cve.org
epss: 0.00159
epssPercentile: 0.05034
ingestedAt: '2026-11-05T22:38:31.626Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix mr leak in RESPST_ERR_RNR

rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr)
to drop mr's ref_cnt in RESPST_ERR_RNR to avoid below warning:

  WARNING: CPU: 0 PID: 4156 at drivers/infiniband/sw/rxe/rxe_pool.c:259 __rxe_cleanup+0x1df/0x240 [rdma_rxe]
...
  Call Trace:
   rxe_dereg_mr+0x4c/0x60 [rdma_rxe]
   ib_dereg_mr_user+0xa8/0x200 [ib_core]
   ib_mr_pool_destroy+0x77/0xb0 [ib_core]
   nvme_rdma_destroy_queue_ib+0x89/0x240 [nvme_rdma]
   nvme_rdma_free_queue+0x40/0x50 [nvme_rdma]
   nvme_rdma_teardown_io_queues.part.0+0xc3/0x120 [nvme_rdma]
   nvme_rdma_error_recovery_work+0x4d/0xf0 [nvme_rdma]
   process_one_work+0x582/0xa40
   ? pwq_dec_nr_in_flight+0x100/0x100
   ? rwlock_bug.part.0+0x60/0x60
   worker_thread+0x2a9/0x700
   ? process_one_work+0xa40/0xa40
   kthread+0x168/0x1a0
   ? kthread_complete_and_exit+0x20/0x20
   ret_from_fork+0x22/0x30

## Affected

- `Linux >= 8a1a0be894da0d06bfbb496cc2dc3057fa83e103 < 50b35ad2864a9d66f802f9ce193d99bbef64e219`
- `Linux >= 8a1a0be894da0d06bfbb496cc2dc3057fa83e103 < b5f9a01fae42684648c2ee3cd9985f80c67ab9f7`
- `Linux 5.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.