Critical Vulnerability in Linux Kernel: Double Destruction of rsv_qp
Summary
DEBIAN-CVE-2025-38582: In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting system integrity and performance. This specific vulnerability affects the RDMA/hns component of the Linux kernel, which is responsible for remote direct memory access functionalities, crucial for high-performance networking.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified where the rsv_qp may be double destroyed during error handling. This occurs first in the free_mr_init() function and then again in hns_roce_exit(). The issue leads to list_del corruption, which can result in system instability and potential crashes. The warning indicates a serious flaw in memory management, which could be exploited to cause denial of service or other unintended behaviors.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks to system stability and performance. It is crucial for users to update their systems to the patched versions to ensure security. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves double destruction of the rsv_qp in the Linux kernel, leading to potential system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring code access. Visit Vulert Scanner to check your application.
Exploitation of this vulnerability may lead to system crashes, instability, and denial of service.
Yes, patches are available for Debian 13 and 14. Ensure to update to the specified versions to mitigate the vulnerability.
Vulert is a service that monitors open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time alerts.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
