CVE-2025-21714 (GCVE-0-2025-21714)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-08-05 11:53
VLAI
Title
RDMA/mlx5: Fix implicit ODP use after free
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use after free Prevent double queueing of implicit ODP mr destroy work by using __xa_cmpxchg() to make sure this is the only time we are destroying this specific mr. Without this change, we could try to invalidate this mr twice, which in turn could result in queuing a MR work destroy twice, and eventually the second work could execute after the MR was freed due to the first work, causing a user after free and trace below. refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130 Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs] CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib] RIP: 0010:refcount_warn_saturate+0x12b/0x130 Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff <0f> 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027 RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0 RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019 R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00 R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0 FS: 0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0x12b/0x130 free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib] process_one_work+0x1cc/0x3c0 worker_thread+0x218/0x3c0 kthread+0xc6/0xf0 ret_from_fork+0x1f/0x30 </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5256edcb98a14b11409a2d323f56a70a8b366363 , < 7cc8f681f6d4ae4478ae0f60485fc768f2b450da (git)
Affected: 5256edcb98a14b11409a2d323f56a70a8b366363 , < edfb65dbb9ffd3102f3ff4dd21316158e56f1976 (git)
Affected: 5256edcb98a14b11409a2d323f56a70a8b366363 , < d3d930411ce390e532470194296658a960887773 (git)
Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:14:41.666348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:30.244Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/odp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7cc8f681f6d4ae4478ae0f60485fc768f2b450da",
              "status": "affected",
              "version": "5256edcb98a14b11409a2d323f56a70a8b366363",
              "versionType": "git"
            },
            {
              "lessThan": "edfb65dbb9ffd3102f3ff4dd21316158e56f1976",
              "status": "affected",
              "version": "5256edcb98a14b11409a2d323f56a70a8b366363",
              "versionType": "git"
            },
            {
              "lessThan": "d3d930411ce390e532470194296658a960887773",
              "status": "affected",
              "version": "5256edcb98a14b11409a2d323f56a70a8b366363",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/odp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix implicit ODP use after free\n\nPrevent double queueing of implicit ODP mr destroy work by using\n__xa_cmpxchg() to make sure this is the only time we are destroying this\nspecific mr.\n\nWithout this change, we could try to invalidate this mr twice, which in\nturn could result in queuing a MR work destroy twice, and eventually the\nsecond work could execute after the MR was freed due to the first work,\ncausing a user after free and trace below.\n\n   refcount_t: underflow; use-after-free.\n   WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130\n   Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs]\n   CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n   Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib]\n   RIP: 0010:refcount_warn_saturate+0x12b/0x130\n   Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff \u003c0f\u003e 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff\n   RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286\n   RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027\n   RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0\n   RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019\n   R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00\n   R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0\n   FS:  0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000\n   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n   CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0\n   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n   Call Trace:\n    \u003cTASK\u003e\n    ? refcount_warn_saturate+0x12b/0x130\n    free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib]\n    process_one_work+0x1cc/0x3c0\n    worker_thread+0x218/0x3c0\n    kthread+0xc6/0xf0\n    ret_from_fork+0x1f/0x30\n    \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attack requires local access to the RDMA verbs uAPI (/dev/infiniband/uverbs*) to register an implicit ODP MR, and the invalidation half of the race requires local mm operations (munmap/madvise) that a remote peer cannot induce. Remote RDMA traffic can drive the page-fault half but not the whole race, so the vector is Local.\nAC:L - The attacker controls both sides of the race from its own process \u2014 repeated ibv_advise_mr prefetch faults on the implicit MR in one thread and munmap/MADV_DONTNEED invalidations of the same range in another \u2014 and can retry the loop indefinitely on many child MRs in parallel. No condition depends on state outside the attacker\u0027s influence.\nPR:L - An unprivileged local account with access to the InfiniBand verbs character device suffices; there is no capability check anywhere on the reg_mr/ODP/prefetch path (only CAP_NET_RAW for raw QPs and CAP_IPC_LOCK for pinning, neither of which applies to ODP). Unprivileged verbs access is the intended design of RDMA and is routine in HPC, RoCE cloud, and containerized deployments.\nUI:N - The attacking process registers its own implicit ODP MR and triggers both the page faults and the invalidations itself. No victim action or cooperation is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed. Standard kernel-local privilege escalation scope.\nC:H - The second execution of free_implicit_child_mr_work() operates on a freed, kzalloc\u0027d mlx5_ib_mr from a generic kmalloc slab, so an attacker who reclaims the object controls mr-\u003eparent, mr-\u003eumem, and mr-\u003emmkey and can turn the dereferences into arbitrary kernel reads. Destroying an mkey number that has been reassigned can additionally expose another RDMA consumer\u0027s registered memory.\nI:H - The double queue_work yields a use-after-free plus a double mlx5_ib_dereg_mr() free, and INIT_WORK() on an already-pending work item corrupts workqueue linked lists \u2014 both classic paths to a controlled write primitive and control-flow hijack via heap spraying.\nA:H - Even unweaponized, the bug produces the refcount_t underflow WARNING and subsequent oops shown in the commit trace, and the underflowed usecount can leave mlx5r_deref_wait_odp_mkey() waiting forever, hanging an unbound workqueue worker. Any of these is a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:53:51.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7cc8f681f6d4ae4478ae0f60485fc768f2b450da"
        },
        {
          "url": "https://git.kernel.org/stable/c/edfb65dbb9ffd3102f3ff4dd21316158e56f1976"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3d930411ce390e532470194296658a960887773"
        }
      ],
      "title": "RDMA/mlx5: Fix implicit ODP use after free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21714",
    "datePublished": "2025-02-27T02:07:25.570Z",
    "dateReserved": "2024-12-29T08:45:45.752Z",
    "dateUpdated": "2026-08-05T11:53:51.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21714",
      "date": "2026-08-05",
      "epss": "0.00196",
      "percentile": "0.0949"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:42:13.000Z",
      "cve": "CVE-2025-21714",
      "id": "msrc_CVE-2025-21714",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:known_affected": "19",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/mlx5: Fix implicit ODP use after free",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21714.json",
      "version": "15"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21714\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T02:15:15.050\",\"lastModified\":\"2026-06-17T08:44:05.723\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/mlx5: Fix implicit ODP use after free\\n\\nPrevent double queueing of implicit ODP mr destroy work by using\\n__xa_cmpxchg() to make sure this is the only time we are destroying this\\nspecific mr.\\n\\nWithout this change, we could try to invalidate this mr twice, which in\\nturn could result in queuing a MR work destroy twice, and eventually the\\nsecond work could execute after the MR was freed due to the first work,\\ncausing a user after free and trace below.\\n\\n   refcount_t: underflow; use-after-free.\\n   WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130\\n   Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs]\\n   CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1\\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n   Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib]\\n   RIP: 0010:refcount_warn_saturate+0x12b/0x130\\n   Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff \u003c0f\u003e 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff\\n   RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286\\n   RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027\\n   RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0\\n   RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019\\n   R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00\\n   R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0\\n   FS:  0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000\\n   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n   CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0\\n   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n   Call Trace:\\n    \u003cTASK\u003e\\n    ? refcount_warn_saturate+0x12b/0x130\\n    free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib]\\n    process_one_work+0x1cc/0x3c0\\n    worker_thread+0x218/0x3c0\\n    kthread+0xc6/0xf0\\n    ret_from_fork+0x1f/0x30\\n    \u003c/TASK\u003e\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/mlx5: Arreglar el uso impl\u00edcito de ODP despu\u00e9s de la liberaci\u00f3n Evitar la puesta en cola doble del trabajo de destrucci\u00f3n de mr de ODP impl\u00edcito mediante __xa_cmpxchg() para asegurarse de que esta sea la \u00fanica vez que destruyamos este mr espec\u00edfico. Sin este cambio, podr\u00edamos intentar invalidar este mr dos veces, lo que a su vez podr\u00eda resultar en poner en cola una destrucci\u00f3n de trabajo de MR dos veces, y eventualmente el segundo trabajo podr\u00eda ejecutarse despu\u00e9s de que el MR se liberara debido al primer trabajo, causando un user after free y un seguimiento a continuaci\u00f3n. refcount_t: desbordamiento insuficiente; use after free. ADVERTENCIA: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130 Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs] CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib] RIP: 0010:refcount_warn_saturate+0x12b/0x130 Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff \u0026lt;0f\u0026gt; 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027 RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0 RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019 R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00 R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0 FS: 0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  ? refcount_warn_saturate+0x12b/0x130 free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib] process_one_work+0x1cc/0x3c0 worker_thread+0x218/0x3c0 kthread+0xc6/0xf0 ret_from_fork+0x1f/0x30  \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/mlx5/odp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5256edcb98a14b11409a2d323f56a70a8b366363\",\"lessThan\":\"7cc8f681f6d4ae4478ae0f60485fc768f2b450da\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5256edcb98a14b11409a2d323f56a70a8b366363\",\"lessThan\":\"edfb65dbb9ffd3102f3ff4dd21316158e56f1976\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5256edcb98a14b11409a2d323f56a70a8b366363\",\"lessThan\":\"d3d930411ce390e532470194296658a960887773\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/mlx5/odp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:14:41.666348Z\",\"id\":\"CVE-2025-21714\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"B933A002-DFC5-4A26-9D4C-8D837AD213ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7cc8f681f6d4ae4478ae0f60485fc768f2b450da\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d3d930411ce390e532470194296658a960887773\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edfb65dbb9ffd3102f3ff4dd21316158e56f1976\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-23T19:31:14+00:00",
      "cve": "CVE-2025-21714",
      "id": "CVE-2025-21714",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "174",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/mlx5: Fix implicit ODP use after free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21714.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21714\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:14:41.666348Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:14:43.209Z\"}}], \"cna\": {\"title\": \"RDMA/mlx5: Fix implicit ODP use after free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The attack requires local access to the RDMA verbs uAPI (/dev/infiniband/uverbs*) to register an implicit ODP MR, and the invalidation half of the race requires local mm operations (munmap/madvise) that a remote peer cannot induce. Remote RDMA traffic can drive the page-fault half but not the whole race, so the vector is Local.\\nAC:L - The attacker controls both sides of the race from its own process \\u2014 repeated ibv_advise_mr prefetch faults on the implicit MR in one thread and munmap/MADV_DONTNEED invalidations of the same range in another \\u2014 and can retry the loop indefinitely on many child MRs in parallel. No condition depends on state outside the attacker\u0027s influence.\\nPR:L - An unprivileged local account with access to the InfiniBand verbs character device suffices; there is no capability check anywhere on the reg_mr/ODP/prefetch path (only CAP_NET_RAW for raw QPs and CAP_IPC_LOCK for pinning, neither of which applies to ODP). Unprivileged verbs access is the intended design of RDMA and is routine in HPC, RoCE cloud, and containerized deployments.\\nUI:N - The attacking process registers its own implicit ODP MR and triggers both the page faults and the invalidations itself. No victim action or cooperation is needed.\\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed. Standard kernel-local privilege escalation scope.\\nC:H - The second execution of free_implicit_child_mr_work() operates on a freed, kzalloc\u0027d mlx5_ib_mr from a generic kmalloc slab, so an attacker who reclaims the object controls mr-\u003eparent, mr-\u003eumem, and mr-\u003emmkey and can turn the dereferences into arbitrary kernel reads. Destroying an mkey number that has been reassigned can additionally expose another RDMA consumer\u0027s registered memory.\\nI:H - The double queue_work yields a use-after-free plus a double mlx5_ib_dereg_mr() free, and INIT_WORK() on an already-pending work item corrupts workqueue linked lists \\u2014 both classic paths to a controlled write primitive and control-flow hijack via heap spraying.\\nA:H - Even unweaponized, the bug produces the refcount_t underflow WARNING and subsequent oops shown in the commit trace, and the underflowed usecount can leave mlx5r_deref_wait_odp_mkey() waiting forever, hanging an unbound workqueue worker. Any of these is a full availability loss.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5256edcb98a14b11409a2d323f56a70a8b366363\", \"lessThan\": \"7cc8f681f6d4ae4478ae0f60485fc768f2b450da\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5256edcb98a14b11409a2d323f56a70a8b366363\", \"lessThan\": \"edfb65dbb9ffd3102f3ff4dd21316158e56f1976\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5256edcb98a14b11409a2d323f56a70a8b366363\", \"lessThan\": \"d3d930411ce390e532470194296658a960887773\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/mlx5/odp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/mlx5/odp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7cc8f681f6d4ae4478ae0f60485fc768f2b450da\"}, {\"url\": \"https://git.kernel.org/stable/c/edfb65dbb9ffd3102f3ff4dd21316158e56f1976\"}, {\"url\": \"https://git.kernel.org/stable/c/d3d930411ce390e532470194296658a960887773\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/mlx5: Fix implicit ODP use after free\\n\\nPrevent double queueing of implicit ODP mr destroy work by using\\n__xa_cmpxchg() to make sure this is the only time we are destroying this\\nspecific mr.\\n\\nWithout this change, we could try to invalidate this mr twice, which in\\nturn could result in queuing a MR work destroy twice, and eventually the\\nsecond work could execute after the MR was freed due to the first work,\\ncausing a user after free and trace below.\\n\\n   refcount_t: underflow; use-after-free.\\n   WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130\\n   Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs]\\n   CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1\\n   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n   Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib]\\n   RIP: 0010:refcount_warn_saturate+0x12b/0x130\\n   Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff \u003c0f\u003e 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff\\n   RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286\\n   RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027\\n   RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0\\n   RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019\\n   R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00\\n   R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0\\n   FS:  0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000\\n   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n   CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0\\n   DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n   DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n   Call Trace:\\n    \u003cTASK\u003e\\n    ? refcount_warn_saturate+0x12b/0x130\\n    free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib]\\n    process_one_work+0x1cc/0x3c0\\n    worker_thread+0x218/0x3c0\\n    kthread+0xc6/0xf0\\n    ret_from_fork+0x1f/0x30\\n    \u003c/TASK\u003e\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.13\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.2\", \"versionStartIncluding\": \"5.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"5.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:53:51.641Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21714\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:53:51.641Z\", \"dateReserved\": \"2024-12-29T08:45:45.752Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:07:25.570Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.