Race Condition Vulnerability in Linux Kernel's RDMA/mxl5 Package
Summary
DEBIAN-CVE-2025-21732: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error This patch addresses a race condition for an ODP MR that can result in a CQE with an e... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The RDMA (Remote Direct Memory Access) subsystem, particularly the mlx5 driver, facilitates high-performance networking by allowing direct memory access from the memory of one computer into that of another without involving the operating system. This vulnerability affects the Linux packages in Debian 13 and 14, specifically targeting the mlx5 driver, which is crucial for efficient data transfer in high-speed networks.
Vulnerability Detail
In the Linux kernel, a race condition has been identified in the RDMA/mxl5 driver that can lead to a Completion Queue Entry (CQE) error. This occurs during the deregistration of a memory region (MR) when one task attempts to invalidate a range for a freed local key (lkey) concurrently with another task deregistering the MR. The improper handling of locks can cause the UMR Queue Pair (QP) to enter an error state, leading to potential data transfer failures and system instability.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The race condition vulnerability in the Linux kernel's RDMA/mxl5 driver poses significant risks to systems relying on high-performance networking. Users are strongly encouraged to update their Linux packages to the patched version to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the RDMA/mxl5 driver of the Linux kernel that can lead to a CQE error.
The vulnerability affects Debian 13 and 14 versions of the Linux package prior to version 6.12.15-1.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to data transfer failures and system instability, affecting applications relying on RDMA for high-speed networking.
Currently, there are no specific workarounds available. It is advisable to apply the patch as soon as it is released.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
