LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21732: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error This patch addresses a race condition for an ODP MR that can result in a CQE with an error on the UMR QP. During the __mlx5_ib_dereg_mr() flow, the following sequence of calls occurs: mlx5_revoke_mr() mlx5r_umr_revoke_mr() mlx5r_umr_post_send_wait() At this point, the lkey is freed from the hardware's perspective. However, concurrently, mlx5_ib_invalidate_range() might be triggered by another task attempting to invalidate a range for the same freed lkey. This task will: - Acquire the umem_odp->umem_mutex lock. - Call mlx5r_umr_update_xlt() on the UMR QP. - Since the lkey has already been freed, this can lead to a CQE error, causing the UMR QP to enter an error state [1]. To resolve this race condition, the umem_odp->umem_mutex lock is now also acquired as part of the mlx5_revoke_mr() scope. Upon successful revoke, we set umem_odp->private which points to that MR to NULL, preventing any further invalidation attempts on its lkey. [1] From dmesg: infiniband rocep8s0f0: dump_cqe:277:(pid 0): WC error: 6, Message: memory bind operation error cqe_dump: 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqe_dump: 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqe_dump: 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cqe_dump: 00000030: 00 00 00 00 08 00 78 06 25 00 11 b9 00 0e dd d2 WARNING: CPU: 15 PID: 1506 at drivers/infiniband/hw/mlx5/umr.c:394 mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib] Modules linked in: ip6table_mangle ip6table_natip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_umad ib_ipoib ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core CPU: 15 UID: 0 PID: 1506 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1626 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5r_umr_post_send_wait+0x15a/0x2b0 [mlx5_ib] [..] Call Trace: <TASK> mlx5r_umr_update_xlt+0x23c/0x3e0 [mlx5_ib] mlx5_ib_invalidate_range+0x2e1/0x330 [mlx5_ib] __mmu_notifier_invalidate_range_start+0x1e1/0x240 zap_page_range_single+0xf1/0x1a0 madvise_vma_behavior+0x677/0x6e0 do_madvise+0x1a2/0x4b0 __x64_sys_madvise+0x25/0x30 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects Mellanox mlx5 RDMA handling. A race while deregistering on-demand-paging memory can leave hardware using a freed key, causing completion errors and pushing the UMR queue pair into an error state. The source material shows reliability impact in RDMA workloads, not confirmed data theft or remote takeover.

Executive priority

Treat this as targeted infrastructure maintenance, not an internet-wide emergency based on supplied evidence. Prioritize environments where RDMA availability directly supports storage, compute, or trading workloads, because failure could disrupt high-value systems even without confirmed exploitation.

Technical view

In RDMA/mlx5 ODP MR deregistration, mlx5_revoke_mr() could free an lkey while mlx5_ib_invalidate_range() concurrently updated the same translation state. The fix extends umem_odp->umem_mutex coverage and clears umem_odp->private after successful revoke, preventing later invalidations against the freed MR lkey.

Likely exposure

Exposure appears limited to Linux systems using the mlx5 InfiniBand/RDMA driver with ODP memory registration paths. The source lists Linux kernel affected ranges beginning at 5.13 and fixed points including 6.12.14, 6.13.3, and 6.14, but package-level distro status is not provided.

Exploitation context

No active exploitation is stated in the supplied sources, and the CVE is not marked KEV. The included evidence is a kernel dmesg warning from an RDMA test path, showing CQE errors and a UMR QP error state. Practical exploitability beyond causing RDMA failures is not established here.

Researcher notes

The root cause is a synchronization gap between MR revoke and ODP range invalidation. The observable failure is a CQE memory-bind error and warning in mlx5r_umr_post_send_wait. Sources do not provide CVSS, CWE, exploitability analysis, distro package status, or evidence of remote attack paths.

Mitigation direction

  • Check vendor or distribution advisories for patched kernel packages containing the referenced fixes.
  • Prioritize RDMA-capable hosts using mlx5_ib, especially production storage, HPC, and low-latency networking nodes.
  • Plan kernel updates to versions including the stable fixes: 6.12.14, 6.13.3, or 6.14 where applicable.
  • If immediate patching is unavailable, review vendor guidance for RDMA or ODP-specific risk reduction.

Validation and detection

  • Inventory Linux hosts with Mellanox mlx5 RDMA hardware and mlx5_ib loaded.
  • Confirm running kernel versions against vendor backport advisories or the fixed upstream versions.
  • Review kernel logs for mlx5_ib UMR CQE errors or related warnings.
  • Validate patched hosts under representative RDMA workloads before broad rollout.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21732 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe6fb246ccafbdfc86e0750af021628132fdbceac, e6fb246ccafbdfc86e0750af021628132fdbceac, e6fb246ccafbdfc86e0750af021628132fdbceacunaffected
LinuxLinux5.13, 0, 6.12.14, 6.13.3, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.