CVE-2025-21886

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21886
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21886.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21886
Downstream
Related
Published
2025-03-27T14:57:13Z
Modified
2025-10-17T22:14:01.968357Z
Summary
RDMA/mlx5: Fix implicit ODP hang on parent deregistration
Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix implicit ODP hang on parent deregistration

Fix the destroyunusedimplicitchildmr() to prevent hanging during parent deregistration as of below [1].

Upon entering destroyunusedimplicitchildmr(), the reference count for the implicit MR parent is incremented using: refcountincnot_zero().

A corresponding decrement must be performed if freeimplicitchildmrwork() is not called.

The code has been updated to properly manage the reference count that was incremented.

[1] INFO: task python3:2157 blocked for more than 120 seconds. Not tainted 6.12.0-rc7+ #1633 "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000 Call Trace: <TASK> _schedule+0x420/0xd30 schedule+0x47/0x130 _mlx5ibderegmr+0x379/0x5d0 [mlx5ib] ? _pfxautoremovewakefunction+0x10/0x10 ibderegmruser+0x5f/0x120 [ibcore] ? lockrelease+0xc6/0x280 destroyhwidruobject+0x1d/0x60 [ibuverbs] uverbsdestroyuobject+0x58/0x1d0 [ibuverbs] uobjdestroy+0x3f/0x70 [ibuverbs] ibuverbscmdverbs+0x3e4/0xbb0 [ibuverbs] ? _pfxuverbsdestroydefhandler+0x10/0x10 [ibuverbs] ? lockacquire+0xc1/0x2f0 ? ibuverbsioctl+0xcb/0x170 [ibuverbs] ? ibuverbsioctl+0x116/0x170 [ibuverbs] ? lockrelease+0xc6/0x280 ibuverbsioctl+0xe7/0x170 [ibuverbs] ? ibuverbsioctl+0xcb/0x170 [ibuverbs] _x64sysioctl+0x1b0/0xa70 ? kmemcachefree+0x221/0x400 dosyscall64+0x6b/0x140 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7f20f21f017b RSP: 002b:00007ffcfc4a77c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b RDX: 00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890 R13: 000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0 </TASK>

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7cc8f681f6d4ae4478ae0f60485fc768f2b450da
Fixed
cb96ae783e7249e8e5a50c22952c0bb2983133df
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
edfb65dbb9ffd3102f3ff4dd21316158e56f1976
Fixed
a095ede2daca49d15e74d66d014883f2fa8bb924
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d3d930411ce390e532470194296658a960887773
Fixed
3d8c6f26893d55fab218ad086719de1fc9bb86ba

Affected versions

v6.*

v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.13
v6.13-rc2
v6.13-rc3
v6.13-rc4
v6.13-rc5
v6.13-rc6
v6.13-rc7
v6.13.2
v6.13.3
v6.13.4
v6.13.5
v6.14-rc1

Database specific

vanir_signatures

[
    {
        "id": "CVE-2025-21886-038bd327",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c",
            "function": "destroy_unused_implicit_child_mr"
        },
        "digest": {
            "function_hash": "254763429640405964799639425925591513433",
            "length": 755.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d8c6f26893d55fab218ad086719de1fc9bb86ba"
    },
    {
        "id": "CVE-2025-21886-37f2567f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c"
        },
        "digest": {
            "line_hashes": [
                "143542370262852903310806228530857618294",
                "11001234297349389986076149470247917890",
                "287269264874912604126343922837761956032",
                "71294352259357974198845790049970087512"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d8c6f26893d55fab218ad086719de1fc9bb86ba"
    },
    {
        "id": "CVE-2025-21886-9fd6d09a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c",
            "function": "destroy_unused_implicit_child_mr"
        },
        "digest": {
            "function_hash": "254763429640405964799639425925591513433",
            "length": 755.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a095ede2daca49d15e74d66d014883f2fa8bb924"
    },
    {
        "id": "CVE-2025-21886-ab166c96",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c"
        },
        "digest": {
            "line_hashes": [
                "143542370262852903310806228530857618294",
                "11001234297349389986076149470247917890",
                "287269264874912604126343922837761956032",
                "71294352259357974198845790049970087512"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a095ede2daca49d15e74d66d014883f2fa8bb924"
    },
    {
        "id": "CVE-2025-21886-eaacaea2",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c"
        },
        "digest": {
            "line_hashes": [
                "143542370262852903310806228530857618294",
                "11001234297349389986076149470247917890",
                "287269264874912604126343922837761956032",
                "71294352259357974198845790049970087512"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb96ae783e7249e8e5a50c22952c0bb2983133df"
    },
    {
        "id": "CVE-2025-21886-f05034cf",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/infiniband/hw/mlx5/odp.c",
            "function": "destroy_unused_implicit_child_mr"
        },
        "digest": {
            "function_hash": "254763429640405964799639425925591513433",
            "length": 755.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb96ae783e7249e8e5a50c22952c0bb2983133df"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.12.13
Fixed
6.12.18
Type
ECOSYSTEM
Events
Introduced
6.13.2
Fixed
6.13.6