Kernel Panic Vulnerability in Linux Package: RDMA/bnxt_re Page Details Issue
Summary
DEBIAN-CVE-2025-21885: In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers While using nvme target with use_srq on, below kernel panic is noticed. Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is responsible for handling system calls, managing memory, and facilitating communication between hardware and software. This vulnerability specifically affects the RDMA (Remote Direct Memory Access) functionality within the bnxt_re driver, which is used for high-performance networking. The vulnerability arises when using the nvme target with the use_srq option enabled, leading to potential kernel panics.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the RDMA/bnxt_re driver that can cause a kernel panic when using the nvme target with the use_srq option enabled. This issue stems from improper handling of page details for shared receive queues (SRQs) created by kernel consumers. The vulnerability can lead to system instability, resulting in crashes and potential data loss. The technical details indicate that the page size and shift information are only set for user space SRQs, neglecting kernel space SRQs, which triggers a divide error during operations.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk of kernel panic.
Conclusion
The vulnerability in the Linux package related to RDMA/bnxt_re can lead to significant system instability and crashes. It is crucial to update to the patched version to mitigate risks. Users should remain vigilant and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel panics, causing system crashes and potential data loss when using specific configurations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux package is 6.12.19-1. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is advisable to limit the use of the nvme target with the use_srq option until the update can be applied.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-21885.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
