Race Condition Vulnerability in Linux Kernel's RDMA/mx5 Package Leading to CQE Errors
Summary
CVE-2025-21732: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error This patch addresses a race condition for an ODP MR that can result in a CQE with an e... Affects linux versions 6.1.106-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. The RDMA (Remote Direct Memory Access) subsystem, particularly the mlx5 driver, facilitates high-performance networking by allowing direct memory access from the memory of one computer into that of another without involving the operating system. This vulnerability affects the mlx5 driver, which is crucial for enabling RDMA functionalities in various environments, particularly in high-performance computing and data centers.
Vulnerability Detail
In the Linux kernel, a race condition exists in the RDMA/mx5 driver that can lead to a Completion Queue Entry (CQE) error. This occurs during the deregistration of a memory region (MR) when the lkey is freed, but another task attempts to invalidate a range for the same lkey concurrently. This can result in the UMR Queue Pair (QP) entering an error state, causing potential disruptions in RDMA operations. The vulnerability is identified as CVE-2025-21732 and can lead to system instability and performance degradation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-21732 vulnerability in the Linux kernel's RDMA/mx5 driver poses a significant risk due to a race condition that can lead to CQE errors. It is crucial for users to update their systems to the patched version of the Linux kernel to ensure stability and performance. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21732 is a vulnerability in the Linux kernel's RDMA/mx5 driver that can cause a race condition leading to CQE errors.
This vulnerability can lead to system instability and performance issues in environments utilizing RDMA functionalities.
You should update your Linux kernel to the latest patched version to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
You can check your application for this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
