{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T07:14:51.061","vulnerabilities":[{"cve":{"id":"CVE-2022-50135","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-06-18T11:15:43.387","lastModified":"2025-11-18T18:08:10.530","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup\n\nThe function rxe_create_qp calls rxe_qp_from_init. If some error\noccurs, the error handler of function rxe_qp_from_init will set\nboth scq and rcq to NULL.\n\nThen rxe_create_qp calls rxe_put to handle qp. In the end,\nrxe_qp_do_cleanup is called by rxe_put. rxe_qp_do_cleanup directly\naccesses scq and rcq before checking them. This will cause\nnull-ptr-deref error.\n\nThe call graph is as below:\n\nrxe_create_qp {\n  ...\n  rxe_qp_from_init {\n    ...\n  err1:\n    ...\n    qp->rcq = NULL;  <---rcq is set to NULL\n    qp->scq = NULL;  <---scq is set to NULL\n    ...\n  }\n\nqp_init:\n  rxe_put{\n    ...\n    rxe_qp_do_cleanup {\n      ...\n      atomic_dec(&qp->scq->num_wq); <--- scq is accessed\n      ...\n      atomic_dec(&qp->rcq->num_wq); <--- rcq is accessed\n    }\n}"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: Corrección BUG: KASAN: null-ptr-deref en rxe_qp_do_cleanup La función rxe_create_qp llama a rxe_qp_from_init. Si ocurre algún error, el controlador de errores de la función rxe_qp_from_init establecerá tanto scq como rcq en NULL. Luego, rxe_create_qp llama a rxe_put para manejar qp. Al final, rxe_put llama a rxe_qp_do_cleanup. rxe_qp_do_cleanup accede directamente a scq y rcq antes de verificarlos. Esto causará un error null-ptr-deref. El gráfico de llamadas es el siguiente: rxe_create_qp { ... rxe_qp_from_init { ... err1: ... qp-&gt;rcq = NULL; &lt;---rcq se establece en NULL qp-&gt;scq = NULL; &lt;---scq se establece en NULL ... } qp_init: rxe_put{ ... rxe_qp_do_cleanup { ... atomic_dec(&amp;qp-&gt;scq-&gt;num_wq); &lt;--- se accede a scq ... atomic_dec(&amp;qp-&gt;rcq-&gt;num_wq); &lt;--- se accede a rcq } }"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-476"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"5.19.2","matchCriteriaId":"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/37da51efe6eaa0560f46803c8c436a48a2084da7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/8598b9d0a364c1663c96fc0fab9df0d36c809aea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]}]}}]}