CVE-2025-21829

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21829", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.776Z", "datePublished": "2025-03-06T16:08:09.054Z", "dateUpdated": "2026-08-05T11:54:46.464Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:54:46.464Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\"\n\nThe Call Trace is as below:\n\"\n <TASK>\n ? show_regs.cold+0x1a/0x1f\n ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n ? __warn+0x84/0xd0\n ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n ? report_bug+0x105/0x180\n ? handle_bug+0x46/0x80\n ? exc_invalid_op+0x19/0x70\n ? asm_exc_invalid_op+0x1b/0x20\n ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n ? __rxe_cleanup+0x124/0x170 [rdma_rxe]\n rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe]\n ib_destroy_qp_user+0x118/0x190 [ib_core]\n rdma_destroy_qp.cold+0x43/0x5e [rdma_cm]\n rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core]\n rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server]\n process_one_work+0x21d/0x3f0\n worker_thread+0x4a/0x3c0\n ? process_one_work+0x3f0/0x3f0\n kthread+0xf0/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n </TASK>\n\"\nWhen too many rdma resources are allocated, rxe needs more time to\nhandle these rdma resources. Sometimes with the current timeout, rxe\ncan not release the rdma resources correctly.\n\nCompared with other rdma drivers, a bigger timeout is used."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The reported reproducer is a network-facing kernel RDMA server (rtrs_srv_close_work) destroying QPs in response to a remote peer's RDMA_CM disconnect; the same teardown path exists in nvmet-rdma, isert, srpt, nfsd svc_rdma and ksmbd smbdirect over Soft-RoCE (UDP/4791), so a remote peer drives both the reference load and the destroy.\nAC:L - The attacker controls both sides of the timing window \u2014 the in-flight traffic and resource count that keep rxe references outstanding, and the disconnect that starts the 200-jiffy (200 ms at HZ=1000) drain timer. Exceeding such a short window under attacker-generated load is trivial and repeatable.\nPR:N - RDMA CM connection setup and teardown occur before any ULP-level authentication in nvmet-rdma, ksmbd smbdirect and rtrs, so an unauthenticated peer reaches the QP-destroy path. Locally the same path needs only /dev/infiniband/uverbs*, which rdma-core makes available to unprivileged users by design.\nUI:N - Triggering requires only that the attacker open, load and drop an RDMA connection (or issue create/destroy verbs); no action by any local user or administrator is needed.\nS:U - The premature free and subsequent memory corruption are confined to kernel memory within the same security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the timeout the object is cleaned up and kfree()'d while references remain live, so packet-processing tasks and skb destructors read through a dangling struct rxe_qp and freed queue memory \u2014 a use-after-free read that can be groomed into arbitrary kernel memory disclosure.\nI:H - The same dangling references are written through (refcount drops, atomic_dec on qp->skb_out, task state updates) after the slab object has been reallocated, giving a heap-spray-controllable write primitive suitable for control-flow hijack.\nA:H - The timeout fires WARN_ON, which is an immediate kernel panic under panic_on_warn=1, and the resulting use-after-free reliably produces oopses and slab corruption crashes; the condition can be re-triggered on every connection teardown."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_pool.c"], "versions": [{"version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "lessThan": "720653309dd31c8a927ef5d87964578ad544980f", "status": "affected", "versionType": "git"}, {"version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "lessThan": "45e567800492088bc52c9abac35524b4d332a8f8", "status": "affected", "versionType": "git"}, {"version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "lessThan": "7a2de8126ed3801f2396720e10a03cd546a3cea1", "status": "affected", "versionType": "git"}, {"version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "lessThan": "a7d15eaecf0d6e13226db629ae2401c8c02683e5", "status": "affected", "versionType": "git"}, {"version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "lessThan": "edc4ef0e0154096d6c0cf5e06af6fc330dbad9d1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/rxe/rxe_pool.c"], "versions": [{"version": "6.0", "status": "affected"}, {"version": "0", "lessThan": "6.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.1.129"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.6.76"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.12.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.13.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/720653309dd31c8a927ef5d87964578ad544980f"}, {"url": "https://git.kernel.org/stable/c/45e567800492088bc52c9abac35524b4d332a8f8"}, {"url": "https://git.kernel.org/stable/c/7a2de8126ed3801f2396720e10a03cd546a3cea1"}, {"url": "https://git.kernel.org/stable/c/a7d15eaecf0d6e13226db629ae2401c8c02683e5"}, {"url": "https://git.kernel.org/stable/c/edc4ef0e0154096d6c0cf5e06af6fc330dbad9d1"}], "title": "RDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\"", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:59:58.958Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_pool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "720653309dd31c8a927ef5d87964578ad544980f", "status": "affected", "version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "versionType": "git"}, {"lessThan": "45e567800492088bc52c9abac35524b4d332a8f8", "status": "affected", "version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "versionType": "git"}, {"lessThan": "7a2de8126ed3801f2396720e10a03cd546a3cea1", "status": "affected", "version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "versionType": "git"}, {"lessThan": "a7d15eaecf0d6e13226db629ae2401c8c02683e5", "status": "affected", "version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "versionType": "git"}, {"lessThan": "edc4ef0e0154096d6c0cf5e06af6fc330dbad9d1", "status": "affected", "version": "215d0a755e1bcd92cbe6a71a21194ce7c82ec106", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/rxe/rxe_pool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.0"}, {"lessThan": "6.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.129", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.76", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.13", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2AA002D6-67A4-467A-9906-F93FAB357DD1", "versionEndExcluding": "6.1.129", "versionStartIncluding": "6.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A6D70701-9CB6-4222-A957-00A419878993", "versionEndExcluding": "6.6.76", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2897389C-A8C3-4D69-90F2-E701B3D66373", "versionEndExcluding": "6.12.13", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3", "versionEndExcluding": "6.13.2", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\"\n\nThe Call Trace is as below:\n\"\n <TASK>\n ? show_regs.cold+0x1a/0x1f\n ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n ? __warn+0x84/0xd0\n ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n ? report_bug+0x105/0x180\n ? handle_bug+0x46/0x80\n ? exc_invalid_op+0x19/0x70\n ? asm_exc_invalid_op+0x1b/0x20\n ? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n ? __rxe_cleanup+0x124/0x170 [rdma_rxe]\n rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe]\n ib_destroy_qp_user+0x118/0x190 [ib_core]\n rdma_destroy_qp.cold+0x43/0x5e [rdma_cm]\n rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core]\n rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server]\n process_one_work+0x21d/0x3f0\n worker_thread+0x4a/0x3c0\n ? process_one_work+0x3f0/0x3f0\n kthread+0xf0/0x120\n ? kthread_complete_and_exit+0x20/0x20\n ret_from_fork+0x22/0x30\n </TASK>\n\"\nWhen too many rdma resources are allocated, rxe needs more time to\nhandle these rdma resources. Sometimes with the current timeout, rxe\ncan not release the rdma resources correctly.\n\nCompared with other rdma drivers, a bigger timeout is used."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/rxe: Se corrige la advertencia \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\" El seguimiento de llamadas es el siguiente: \" ? show_regs.cold+0x1a/0x1f ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __warn+0x84/0xd0 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? report_bug+0x105/0x180 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? __rxe_cleanup+0x12c/0x170 [rdma_rxe] ? __rxe_cleanup+0x124/0x170 [rdma_rxe] rxe_destroy_qp.cold+0x24/0x29 [rdma_rxe] ib_destroy_qp_user+0x118/0x190 [ib_core] rdma_destroy_qp.cold+0x43/0x5e [rdma_cm] rtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core] rtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server] process_one_work+0x21d/0x3f0 worker_thread+0x4a/0x3c0 ? process_one_work+0x3f0/0x3f0 kthread+0xf0/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 \"Cuando se asignan demasiados recursos rdma, rxe necesita m\u00e1s tiempo para gestionar estos recursos rdma. A veces, con el tiempo de espera actual, rxe no puede liberar los recursos rdma correctamente. En comparaci\u00f3n con otros controladores rdma, se utiliza un tiempo de espera mayor."}], "id": "CVE-2025-21829", "lastModified": "2026-07-30T06:21:39.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-06T17:15:22.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/45e567800492088bc52c9abac35524b4d332a8f8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/720653309dd31c8a927ef5d87964578ad544980f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7a2de8126ed3801f2396720e10a03cd546a3cea1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a7d15eaecf0d6e13226db629ae2401c8c02683e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/edc4ef0e0154096d6c0cf5e06af6fc330dbad9d1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: RDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\"", "id": "2350400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350400"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/rxe: Fix the warning \"__rxe_cleanup+0x12c/0x170 [rdma_rxe]\"\nThe Call Trace is as below:\n\"\n<TASK>\n? show_regs.cold+0x1a/0x1f\n? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n? __warn+0x84/0xd0\n? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n? report_bug+0x105/0x180\n? handle_bug+0x46/0x80\n? exc_invalid_op+0x19/0x70\n? asm_exc_invalid_op+0x1b/0x20\n? __rxe_cleanup+0x12c/0x170 [rdma_rxe]\n? __rxe_cleanup+0x124/0x170 [rdma_rxe]\nrxe_destroy_qp.cold+0x24/0x29 [rdma_rxe]\nib_destroy_qp_user+0x118/0x190 [ib_core]\nrdma_destroy_qp.cold+0x43/0x5e [rdma_cm]\nrtrs_cq_qp_destroy.cold+0x1d/0x2b [rtrs_core]\nrtrs_srv_close_work.cold+0x1b/0x31 [rtrs_server]\nprocess_one_work+0x21d/0x3f0\nworker_thread+0x4a/0x3c0\n? process_one_work+0x3f0/0x3f0\nkthread+0xf0/0x120\n? kthread_complete_and_exit+0x20/0x20\nret_from_fork+0x22/0x30\n</TASK>\n\"\nWhen too many rdma resources are allocated, rxe needs more time to\nhandle these rdma resources. Sometimes with the current timeout, rxe\ncan not release the rdma resources correctly.\nCompared with other rdma drivers, a bigger timeout is used."], "name": "CVE-2025-21829", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21829\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21829\nhttps://lore.kernel.org/linux-cve-announce/2025030611-CVE-2025-21829-50f9@gregkh/T"], "threat_severity": "Low"}

{}