Critical Vulnerability in Linux Kernel: RDMA/rtrs Deinitialization Flaw
Summary
DEBIAN-CVE-2025-21805: In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Add missing deinit() call A warning is triggered when repeatedly connecting and disconnecting the rnbd: list_add corruption. Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and extensive support for various hardware architectures. However, it is not immune to vulnerabilities. The specific issue at hand involves the RDMA (Remote Direct Memory Access) subsystem, particularly the rtrs (Reliable Transport Service) component, which facilitates efficient data transfer over networks. This vulnerability can lead to system instability when connecting and disconnecting repeatedly.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RDMA/rtrs component, where a missing deinit() call can lead to list_add corruption. This issue manifests as a warning during repeated connection and disconnection attempts, indicating that the linked list structure is compromised. The warning message specifies that the previous node's next pointer does not match the expected value, which can lead to undefined behavior and potential system crashes. This vulnerability was introduced by commit 667db86bcbe8, which registered an IB event handler without properly implementing its deinitialization.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid repeated connections and disconnections to the RDMA/rtrs component until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel's RDMA/rtrs component poses a significant risk of system instability due to improper handling of linked list structures. Users are encouraged to update their systems to the patched version to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system instability and crashes due to corrupted linked list structures in the RDMA subsystem.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the vulnerability has been fixed in the Linux kernel version 6.12.13-1 and later.
While there are no specific workarounds, it is advisable to limit the use of the RDMA/rtrs component until the patch is applied.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
