{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50472", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-04T15:13:33.466Z", "datePublished": "2025-10-04T15:16:34.180Z", "dateUpdated": "2026-08-05T08:58:53.300Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:58:53.300Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mad: Don't call to function that might sleep while in atomic context\n\nTracepoints are not allowed to sleep, as such the following splat is\ngenerated due to call to ib_query_pkey() in atomic context.\n\nWARNING: CPU: 0 PID: 1888000 at kernel/trace/ring_buffer.c:2492 rb_commit+0xc1/0x220\nCPU: 0 PID: 1888000 Comm: kworker/u9:0 Kdump: loaded Tainted: G OE --------- - - 4.18.0-305.3.1.el8.x86_64 #1\n Hardware name: Red Hat KVM, BIOS 1.13.0-2.module_el8.3.0+555+a55c8938 04/01/2014\n Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]\n RIP: 0010:rb_commit+0xc1/0x220\n RSP: 0000:ffffa8ac80f9bca0 EFLAGS: 00010202\n RAX: ffff8951c7c01300 RBX: ffff8951c7c14a00 RCX: 0000000000000246\n RDX: ffff8951c707c000 RSI: ffff8951c707c57c RDI: ffff8951c7c14a00\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: ffff8951c7c01300 R11: 0000000000000001 R12: 0000000000000246\n R13: 0000000000000000 R14: ffffffff964c70c0 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff8951fbc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f20e8f39010 CR3: 000000002ca10005 CR4: 0000000000170ef0\n Call Trace:\n ring_buffer_unlock_commit+0x1d/0xa0\n trace_buffer_unlock_commit_regs+0x3b/0x1b0\n trace_event_buffer_commit+0x67/0x1d0\n trace_event_raw_event_ib_mad_recv_done_handler+0x11c/0x160 [ib_core]\n ib_mad_recv_done+0x48b/0xc10 [ib_core]\n ? trace_event_raw_event_cq_poll+0x6f/0xb0 [ib_core]\n __ib_process_cq+0x91/0x1c0 [ib_core]\n ib_cq_poll_work+0x26/0x80 [ib_core]\n process_one_work+0x1a7/0x360\n ? create_worker+0x1a0/0x1a0\n worker_thread+0x30/0x390\n ? create_worker+0x1a0/0x1a0\n kthread+0x116/0x130\n ? kthread_flush_work_fn+0x10/0x10\n ret_from_fork+0x35/0x40\n ---[ end trace 78ba8509d3830a16 ]---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable path is ib_mad_recv_done processing MAD completions; RoCE ports advertise RDMA_CORE_CAP_IB_MAD so CM/GSI MADs arrive over Ethernet/IP, and prior MAD DoS CVEs were scored Network.\nAC:L - With the ib_mad recv/send tracepoint enabled (a realistic RDMA debugging deployment, and how this splat was hit in practice), an attacker can reliably trigger the path by sending MAD packets; no uncontrolled race or layout dependency.\nPR:N - The tracepoint runs immediately after validate_mad() format checks and before any MAD agent auth or management-key checks, so an unauthenticated fabric/RoCE peer can reach it.\nUI:N - Exploitation requires only sending MAD traffic to the victim; no victim user action is needed.\nS:U - Impact is confined to the host kernel’s availability (WARN/deadlock/hang); it does not cross a VM, IOMMU, or other security authority boundary.\nC:N - This is a sleep-in-atomic/tracepoint locking bug with no out-of-bounds read, UAF, or other information-disclosure primitive.\nI:N - There is no memory corruption or write primitive—only an illegal sleep under the ftrace ring-buffer critical section—so integrity is unaffected.\nA:H - ib_query_pkey() may sleep (GFP_KERNEL, mlx5_cmd_exec) while the ring buffer is locked, causing scheduling-while-atomic warnings and potential deadlock/hang of the MAD completion path." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/mad.c", "include/trace/events/ib_mad.h" ], "versions": [ { "version": "821bf1de45a1a084e2e11b1a2308777434194bfe", "lessThan": "d45e6ccb8e98d8339631f32984d345a663e74ce2", "status": "affected", "versionType": "git" }, { "version": "821bf1de45a1a084e2e11b1a2308777434194bfe", "lessThan": "47e31b86edff36f2d26cbc88ce695d98ff804178", "status": "affected", "versionType": "git" }, { "version": "821bf1de45a1a084e2e11b1a2308777434194bfe", "lessThan": "cea70a572c0cb9728d728cfebe7d5bd485e97513", "status": "affected", "versionType": "git" }, { "version": "821bf1de45a1a084e2e11b1a2308777434194bfe", "lessThan": "fa8a2f3be78e4585996bcf4c15e4504441a4c7a0", "status": "affected", "versionType": "git" }, { "version": "821bf1de45a1a084e2e11b1a2308777434194bfe", "lessThan": "5c20311d76cbaeb7ed2ecf9c8b8322f8fc4a7ae3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/core/mad.c", "include/trace/events/ib_mad.h" ], "versions": [ { "version": "5.2", "status": "affected" }, { "version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.86", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0.16", "lessThanOrEqual": "6.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.2", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.86" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.0.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d45e6ccb8e98d8339631f32984d345a663e74ce2" }, { "url": "https://git.kernel.org/stable/c/47e31b86edff36f2d26cbc88ce695d98ff804178" }, { "url": "https://git.kernel.org/stable/c/cea70a572c0cb9728d728cfebe7d5bd485e97513" }, { "url": "https://git.kernel.org/stable/c/fa8a2f3be78e4585996bcf4c15e4504441a4c7a0" }, { "url": "https://git.kernel.org/stable/c/5c20311d76cbaeb7ed2ecf9c8b8322f8fc4a7ae3" } ], "title": "IB/mad: Don't call to function that might sleep while in atomic context", "x_generator": { "engine": "bippy-1.2.0" } } } }