In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix implicit ODP hang on parent deregistration
Fix the destroyunusedimplicitchildmr() to prevent hanging during parent deregistration as of below [1].
Upon entering destroyunusedimplicitchildmr(), the reference count for the implicit MR parent is incremented using: refcountincnot_zero().
A corresponding decrement must be performed if freeimplicitchildmrwork() is not called.
The code has been updated to properly manage the reference count that was incremented.
[1] INFO: task python3:2157 blocked for more than 120 seconds. Not tainted 6.12.0-rc7+ #1633 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000 Call Trace: <TASK> _schedule+0x420/0xd30 schedule+0x47/0x130 _mlx5ibderegmr+0x379/0x5d0 [mlx5ib] ? _pfxautoremovewakefunction+0x10/0x10 ibderegmruser+0x5f/0x120 [ibcore] ? lockrelease+0xc6/0x280 destroyhwidruobject+0x1d/0x60 [ibuverbs] uverbsdestroyuobject+0x58/0x1d0 [ibuverbs] uobjdestroy+0x3f/0x70 [ibuverbs] ibuverbscmdverbs+0x3e4/0xbb0 [ibuverbs] ? _pfxuverbsdestroydefhandler+0x10/0x10 [ibuverbs] ? lockacquire+0xc1/0x2f0 ? ibuverbsioctl+0xcb/0x170 [ibuverbs] ? ibuverbsioctl+0x116/0x170 [ibuverbs] ? lockrelease+0xc6/0x280 ibuverbsioctl+0xe7/0x170 [ibuverbs] ? ibuverbsioctl+0xcb/0x170 [ibuverbs] _x64sysioctl+0x1b0/0xa70 ? kmemcachefree+0x221/0x400 dosyscall64+0x6b/0x140 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7f20f21f017b RSP: 002b:00007ffcfc4a77c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b RDX: 00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890 R13: 000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0 </TASK>
[
    {
        "id": "CVE-2025-21886-038bd327",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c",
            "function": "destroy_unused_implicit_child_mr"
        },
        "digest": {
            "function_hash": "254763429640405964799639425925591513433",
            "length": 755.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d8c6f26893d55fab218ad086719de1fc9bb86ba"
    },
    {
        "id": "CVE-2025-21886-37f2567f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c"
        },
        "digest": {
            "line_hashes": [
                "143542370262852903310806228530857618294",
                "11001234297349389986076149470247917890",
                "287269264874912604126343922837761956032",
                "71294352259357974198845790049970087512"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d8c6f26893d55fab218ad086719de1fc9bb86ba"
    },
    {
        "id": "CVE-2025-21886-9fd6d09a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c",
            "function": "destroy_unused_implicit_child_mr"
        },
        "digest": {
            "function_hash": "254763429640405964799639425925591513433",
            "length": 755.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a095ede2daca49d15e74d66d014883f2fa8bb924"
    },
    {
        "id": "CVE-2025-21886-ab166c96",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c"
        },
        "digest": {
            "line_hashes": [
                "143542370262852903310806228530857618294",
                "11001234297349389986076149470247917890",
                "287269264874912604126343922837761956032",
                "71294352259357974198845790049970087512"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a095ede2daca49d15e74d66d014883f2fa8bb924"
    },
    {
        "id": "CVE-2025-21886-eaacaea2",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c"
        },
        "digest": {
            "line_hashes": [
                "143542370262852903310806228530857618294",
                "11001234297349389986076149470247917890",
                "287269264874912604126343922837761956032",
                "71294352259357974198845790049970087512"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb96ae783e7249e8e5a50c22952c0bb2983133df"
    },
    {
        "id": "CVE-2025-21886-f05034cf",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c",
            "function": "destroy_unused_implicit_child_mr"
        },
        "digest": {
            "function_hash": "254763429640405964799639425925591513433",
            "length": 755.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb96ae783e7249e8e5a50c22952c0bb2983133df"
    }
]