Kernel Panic Vulnerability in Linux Package: RDMA/bnxt_re Page Details Issue
Summary
CVE-2025-21885: In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers While using nvme target with use_srq on, below kernel panic is noticed. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including memory management, process scheduling, and device control. The bnxt_re driver is specifically designed for RDMA (Remote Direct Memory Access) operations, enabling efficient data transfer between computers. However, a vulnerability has been identified that affects the page details for shared receive queues (SRQs) created by kernel consumers, leading to potential kernel panics.
Vulnerability Detail
The vulnerability, identified as CVE-2025-21885, arises when using NVMe targets with the use_srq option enabled. This results in a kernel panic due to a divide error occurring in the bnxt_re driver. The error is triggered during the allocation and initialization of hardware queues, specifically in the function bnxt_qplib_alloc_init_hwq. The issue is exacerbated by the fact that page size and shift information are only set for user space SRQs, leaving kernel space SRQs vulnerable. This can lead to system instability and crashes, affecting the overall reliability of systems utilizing this driver.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to monitor the system for any kernel panics and apply the patch as soon as it is available.
Conclusion
CVE-2025-21885 represents a significant vulnerability in the Linux kernel's bnxt_re driver, which can lead to kernel panics under specific conditions. Users are urged to update their systems to the patched version to mitigate risks. Regular monitoring and timely updates are essential for maintaining system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21885 is a vulnerability in the Linux kernel related to the bnxt_re driver, which can cause kernel panics when using NVMe targets with shared receive queues.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to kernel panics, causing system instability and crashes, which can disrupt services and affect data integrity.
Yes, a patch is available for Debian 13 users in version 6.12.19-1. It is recommended to update to this version or later.
While there are no specific workarounds, it is crucial to monitor your system for any signs of kernel panics and plan to apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
