CVE-2025-38582 (GCVE-0-2025-38582)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
RDMA/hns: Fix double destruction of rsv_qp
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init(). list_del corruption, ffff589732eb9b50->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 ... Call trace: __list_del_entry_valid+0x148/0x240 hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0x50/0x100 [hclge] process_one_work+0x250/0x9a0 worker_thread+0x324/0x990 kthread+0x190/0x210 ret_from_fork+0x10/0x18
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fd8489294dd2beefb70f12ec4f6132aeec61a4d0 , < dab173bae3303f074f063750a8dead2550d8c782 (git)
Affected: fd8489294dd2beefb70f12ec4f6132aeec61a4d0 , < fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea (git)
Affected: fd8489294dd2beefb70f12ec4f6132aeec61a4d0 , < 10b083dbba22be19baa848432b6f25aa68ab2db5 (git)
Affected: fd8489294dd2beefb70f12ec4f6132aeec61a4d0 , < c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8 (git)
Affected: 2ccf1c75d39949d8ea043d04a2e92d7100ea723d (git)
Affected: d2d9c5127122745da6e887f451dd248cfeffca33 (git)
Affected: dac2723d8bfa9cf5333f477741e6e5fa1ed34645 (git)
Affected: 60595923371c2ebe7faf82536c47eb0c967e3425 (git)
Affected: 6.1.113 , < 6.2 (semver)
Affected: 6.6.54 , < 6.7 (semver)
Affected: 6.10.13 , < 6.11 (semver)
Affected: 6.11.2 , < 6.12 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_hw_v2.c",
            "drivers/infiniband/hw/hns/hns_roce_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dab173bae3303f074f063750a8dead2550d8c782",
              "status": "affected",
              "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
              "versionType": "git"
            },
            {
              "lessThan": "fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea",
              "status": "affected",
              "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
              "versionType": "git"
            },
            {
              "lessThan": "10b083dbba22be19baa848432b6f25aa68ab2db5",
              "status": "affected",
              "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
              "versionType": "git"
            },
            {
              "lessThan": "c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8",
              "status": "affected",
              "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2ccf1c75d39949d8ea043d04a2e92d7100ea723d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d2d9c5127122745da6e887f451dd248cfeffca33",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dac2723d8bfa9cf5333f477741e6e5fa1ed34645",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "60595923371c2ebe7faf82536c47eb0c967e3425",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_hw_v2.c",
            "drivers/infiniband/hw/hns/hns_roce_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.113",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix double destruction of rsv_qp\n\nrsv_qp may be double destroyed in error flow, first in free_mr_init(),\nand then in hns_roce_exit(). Fix it by moving the free_mr_init() call\ninto hns_roce_v2_init().\n\nlist_del corruption, ffff589732eb9b50-\u003enext is LIST_POISON1 (dead000000000100)\nWARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240\n...\nCall trace:\n __list_del_entry_valid+0x148/0x240\n hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2]\n hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2]\n hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2]\n free_mr_exit+0x6c/0x120 [hns_roce_hw_v2]\n hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2]\n hns_roce_exit+0x118/0x350 [hns_roce_hw_v2]\n __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2]\n hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2]\n hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2]\n hclge_notify_roce_client+0x6c/0x160 [hclge]\n hclge_reset_rebuild+0x150/0x5c0 [hclge]\n hclge_reset+0x10c/0x140 [hclge]\n hclge_reset_subtask+0x80/0x104 [hclge]\n hclge_reset_service_task+0x168/0x3ac [hclge]\n hclge_service_task+0x50/0x100 [hclge]\n process_one_work+0x250/0x9a0\n worker_thread+0x324/0x990\n kthread+0x190/0x210\n ret_from_fork+0x10/0x18"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect lives in the hns_roce HIP08 device init/re-init path (`__hns_roce_hw_v2_init_instance()` \u2192 `free_mr_init()`), reached via driver probe, module load, or the hns3 NIC reset-recovery notifier \u2014 never from remote packet data. Reaching or influencing it requires local access to the machine (RDMA uverbs devices, memory/resource pressure, or a locally initiated reset).\nAC:L - The double destruction fires whenever `free_mr_alloc_res()` fails partway through creating the 8 reserved QPs, since the `create_failed_qp` unwind kfree()s `free_mr-\u003ersv_qp[i]` without NULLing the array slot, leaving dangling pointers that `hns_roce_v2_exit()` \u2192 `free_mr_exit()` destroys and frees a second time. A local attacker can influence exactly that partial-failure window by driving slab/QP/CQ/PD resource exhaustion so one of the eight allocations fails after earlier ones succeeded, and the init/reset sequence is repeatable, so the required conditions are not beyond the attacker\u0027s control.\nPR:L - No authentication beyond ordinary local access is needed to create the precondition \u2014 an unprivileged user holding the usual `/dev/infiniband/uverbs*` access in an RDMA deployment can exhaust QP/CQ/PD and memory resources to make the reserved-resource allocation fail mid-loop. The init/reset trigger itself is not gated by any capability check inside the vulnerable code path.\nUI:N - The faulty unwind executes automatically inside the driver\u0027s own error path during device initialization or NIC reset recovery. No victim has to open a file, mount anything, or take any other action.\nS:U - The corrupted objects (`struct hns_roce_qp`, its lists and the kernel slab) all belong to the kernel\u0027s own security authority. There is no crossing into a hypervisor, IOMMU, or other separate security scope.\nC:H - The second `hns_roce_v2_destroy_qp()` operates entirely on freed memory \u2014 it reads `hr_qp-\u003eibqp.send_cq`/`recv_cq` and passes them to `to_hr_cq()`/`__hns_roce_v2_cq_clean()`, and uses `hr_qp-\u003eqpn` for `__xa_erase()`. If the reclaimed slab object is groomed by the attacker, those become fully controlled pointers, yielding an arbitrary kernel-memory read primitive.\nI:H - `hns_roce_qp_remove()` performs three `list_del()` unlinks on the freed object, each writing `prev-\u003enext = next; next-\u003eprev = prev` with pointers taken from reclaimed slab memory \u2014 a classic controlled-write primitive \u2014 and the object is then kfree()d a second time, corrupting the freelist. That combination is exploitable for control-flow hijack and privilege escalation.\nA:H - The reported failure is an immediate `list_del corruption ... LIST_POISON1` WARNING in `__list_del_entry_valid()` from `hns_roce_qp_remove()`, and the double kfree() corrupts the slab allocator. This reliably produces an oops/panic and leaves the RDMA device unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:09.343Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dab173bae3303f074f063750a8dead2550d8c782"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/10b083dbba22be19baa848432b6f25aa68ab2db5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8"
        }
      ],
      "title": "RDMA/hns: Fix double destruction of rsv_qp",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38582",
    "datePublished": "2025-08-19T17:03:04.535Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-08-05T12:03:09.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38582",
      "date": "2026-09-30",
      "epss": "0.00169",
      "percentile": "0.05613"
    },
    "microsoft_vex": {
      "current_release_date": "2025-12-02T01:41:26.000Z",
      "cve": "CVE-2025-38582",
      "id": "msrc_CVE-2025-38582",
      "initial_release_date": "2025-08-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/hns: Fix double destruction of rsv_qp",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38582.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/hns/hns_roce_hw_v2.c",
                  "drivers/infiniband/hw/hns/hns_roce_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dab173bae3303f074f063750a8dead2550d8c782",
                    "status": "affected",
                    "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea",
                    "status": "affected",
                    "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "10b083dbba22be19baa848432b6f25aa68ab2db5",
                    "status": "affected",
                    "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8",
                    "status": "affected",
                    "version": "fd8489294dd2beefb70f12ec4f6132aeec61a4d0",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "2ccf1c75d39949d8ea043d04a2e92d7100ea723d",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d2d9c5127122745da6e887f451dd248cfeffca33",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "dac2723d8bfa9cf5333f477741e6e5fa1ed34645",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "60595923371c2ebe7faf82536c47eb0c967e3425",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "affected",
                    "version": "6.10.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "affected",
                    "version": "6.11.2",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/hw/hns/hns_roce_hw_v2.c",
                  "drivers/infiniband/hw/hns/hns_roce_main.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD1E867E-A1BB-432A-B45E-6471038ABF8D",
                    "versionEndExcluding": "6.2",
                    "versionStartIncluding": "6.1.113",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4945C6F4-5AF9-439E-808F-F1B33A5EFA55",
                    "versionEndExcluding": "6.7",
                    "versionStartIncluding": "6.6.54",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B88D322F-6F03-45A1-8C58-9E45EAB64B13",
                    "versionEndExcluding": "6.11",
                    "versionStartIncluding": "6.10.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FCE0DA8E-611F-4418-9F1A-1899AC9436BE",
                    "versionEndExcluding": "6.12.42",
                    "versionStartIncluding": "6.11.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142",
                    "versionEndExcluding": "6.15.10",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
                    "versionEndExcluding": "6.16.1",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix double destruction of rsv_qp\n\nrsv_qp may be double destroyed in error flow, first in free_mr_init(),\nand then in hns_roce_exit(). Fix it by moving the free_mr_init() call\ninto hns_roce_v2_init().\n\nlist_del corruption, ffff589732eb9b50-\u003enext is LIST_POISON1 (dead000000000100)\nWARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240\n...\nCall trace:\n __list_del_entry_valid+0x148/0x240\n hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2]\n hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2]\n hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2]\n free_mr_exit+0x6c/0x120 [hns_roce_hw_v2]\n hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2]\n hns_roce_exit+0x118/0x350 [hns_roce_hw_v2]\n __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2]\n hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2]\n hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2]\n hclge_notify_roce_client+0x6c/0x160 [hclge]\n hclge_reset_rebuild+0x150/0x5c0 [hclge]\n hclge_reset+0x10c/0x140 [hclge]\n hclge_reset_subtask+0x80/0x104 [hclge]\n hclge_reset_service_task+0x168/0x3ac [hclge]\n hclge_service_task+0x50/0x100 [hclge]\n process_one_work+0x250/0x9a0\n worker_thread+0x324/0x990\n kthread+0x190/0x210\n ret_from_fork+0x10/0x18"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/hns: Se corrige la doble destrucci\u00f3n de rsv_qp. rsv_qp puede sufrir una doble destrucci\u00f3n en el flujo de errores, primero en free_mr_init() y luego en hns_roce_exit(). Se corrige trasladando la llamada a free_mr_init() a hns_roce_v2_init(). Corrupci\u00f3n de list_del, ffff589732eb9b50-\u0026gt;el siguiente es LIST_POISON1 (dead000000000100) ADVERTENCIA: CPU: 8 PID: 1047115 en lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 ... Rastreo de llamadas:  __list_del_entry_valid+0x148/0x240 hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0x50/0x100 [hclge] process_one_work+0x250/0x9a0 worker_thread+0x324/0x990 kthread+0x190/0x210 ret_from_fork+0x10/0x18 "
          }
        ],
        "id": "CVE-2025-38582",
        "lastModified": "2026-07-30T06:23:28.500",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-08-19T17:15:35.430",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/10b083dbba22be19baa848432b6f25aa68ab2db5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dab173bae3303f074f063750a8dead2550d8c782"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-415"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:23:01+00:00",
      "cve": "CVE-2025-38582",
      "id": "CVE-2025-38582",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: RDMA/hns: Fix double destruction of rsv_qp",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38582.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.