---
id: CVE-2022-50135
title: 'RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup

  The function rxe_create_qp calls rxe_qp_from_init. If some error
  occurs, the error handler of function rx…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4703b4f0d94a5f887297713a2f6c2916a1ef08fd <
    8598b9d0a364c1663c96fc0fab9df0d36c809aea
  - >-
    Linux >= 4703b4f0d94a5f887297713a2f6c2916a1ef08fd <
    37da51efe6eaa0560f46803c8c436a48a2084da7
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:55:05.892280Z'
published: '2025-06-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:18.324Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-50135'
references:
  - url: 'https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea'
  - url: 'https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7'
tags:
  - cve.org
epss: 0.00209
epssPercentile: 0.11123
ingestedAt: '2026-11-05T22:38:31.685Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup

The function rxe_create_qp calls rxe_qp_from_init. If some error
occurs, the error handler of function rxe_qp_from_init will set
both scq and rcq to NULL.

Then rxe_create_qp calls rxe_put to handle qp. In the end,
rxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly
accesses scq and rcq before checking them. This will cause
null-ptr-deref error.

The call graph is as below:

rxe_create_qp {
  ...
  rxe_qp_from_init {
    ...
  err1:
    ...
    qp->rcq = NULL;  <---rcq is set to NULL
    qp->scq = NULL;  <---scq is set to NULL
    ...
  }

qp_init:
  rxe_put{
    ...
    rxe_qp_do_cleanup {
      ...
      atomic_dec(&qp->scq->num_wq); <--- scq is accessed
      ...
      atomic_dec(&qp->rcq->num_wq); <--- rcq is accessed
    }
}

## Affected

- `Linux >= 4703b4f0d94a5f887297713a2f6c2916a1ef08fd < 8598b9d0a364c1663c96fc0fab9df0d36c809aea`
- `Linux >= 4703b4f0d94a5f887297713a2f6c2916a1ef08fd < 37da51efe6eaa0560f46803c8c436a48a2084da7`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.