Critical Recovery Flow Vulnerability in Linux Kernel (CVE-2025-21892)
Summary
DEBIAN-CVE-2025-21892: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix the recovery flow of the UMR QP This patch addresses an issue in the recovery flow of the UMR QP, ensuring tasks do not get stuck, as hig... Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its robustness and versatility, supporting a wide range of devices and applications. However, vulnerabilities can arise, impacting system stability and security. This specific vulnerability affects the recovery flow of the UMR Queue Pair (QP), which is crucial for managing memory and data transfers in RDMA (Remote Direct Memory Access) operations.
Vulnerability Detail
In the Linux kernel, a race condition in the recovery flow of the UMR QP can lead to tasks becoming stuck and lost Completion Queue Entries (CQEs). This occurs when the software does not wait for all outstanding Work Requests (WRs) to complete before transitioning the QP to the RESET state. As a result, some flushed CQEs with errors may be discarded, violating the IB specification. The vulnerability can cause significant disruptions in RDMA operations, leading to performance degradation and potential system instability.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the hung task timeout message by executing the command: 'echo 0 > /proc/sys/kernel/hung_task_timeout_secs'. However, this does not resolve the underlying issue and should only be used as a short-term measure.
Conclusion
The CVE-2025-21892 vulnerability in the Linux kernel poses significant risks to system stability and performance due to issues in the recovery flow of the UMR QP. It is crucial to update to the patched version to mitigate these risks. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert for ongoing protection.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21892 is a vulnerability in the Linux kernel that affects the recovery flow of the UMR Queue Pair, potentially causing tasks to become stuck and leading to lost Completion Queue Entries.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The vulnerability can lead to performance issues, system instability, and disruptions in RDMA operations, affecting applications that rely on these functionalities.
Yes, updating the Linux package to version 6.12.19-1 or later resolves the vulnerability and ensures proper management of the UMR QP recovery flow.
If an immediate update is not possible, consider applying the temporary workaround to disable the hung task timeout message, but be aware that this does not fix the underlying issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
