Security readout for executives and security teams
Plain-English summary
A Linux kernel cleanup error can leave an RDMA event handler registered after an RTRS/RNBD connection is torn down. Repeated connection cycles may then corrupt an internal kernel list and trigger warnings, potentially destabilizing affected systems. The supplied record rates this critical, although it does not document a successful attack or observed business impact.
Executive priority
Treat this as an expedited kernel maintenance issue for environments actively using RTRS/RNBD, especially across less-trusted network boundaries. Confirm feature usage before assuming broad fleet exposure. The source assigns CVSS 9.8, but supplied evidence demonstrates list corruption rather than confirmed compromise, data theft, or active exploitation.
Technical view
Commit 667db86bcbe8 introduced an RTRS deinitialization callback but did not invoke it. Consequently, the InfiniBand event handler may remain registered and be added again during later connections, causing list corruption. The referenced stable commits correct the lifecycle by calling deinit() so the handler is properly unregistered.
Likely exposure
Exposure is limited to Linux systems using the RDMA RTRS/RNBD functionality and affected kernel code. The supplied version list is flattened and ambiguous, so administrators should compare their exact kernel version or source commit with the official CVE record and referenced stable fixes. Systems not using this functionality are less likely to reach the vulnerable path.
Exploitation context
The supplied bundle says this CVE is not in KEV and provides no evidence of active exploitation or a public exploit. The documented trigger involves repeated RNBD connection and disconnection. Network reachability alone does not establish practical exploitability; RDMA configuration and affected-feature usage matter.
Researcher notes
The strongest evidence supports an event-handler lifecycle defect and reproducible kernel list corruption. No CWE is supplied. The source bundle does not establish how corruption could produce the confidentiality and integrity impacts asserted by the CVSS vector. Researchers should distinguish the confirmed warning and cleanup flaw from unproven code execution or privilege escalation outcomes.
Mitigation direction
- Inventory Linux systems using RTRS, RNBD, RDMA, or InfiniBand components.
- Obtain a corrected kernel containing the applicable referenced stable fix from the system distributor.
- Follow vendor guidance for the exact kernel branch; the supplied sources name no standalone workaround.
- Prioritize remediation where untrusted systems can reach the relevant RDMA service.
Validation and detection
- Record each system's exact kernel package, version, and source commit where available.
- Confirm whether RTRS, RNBD, and associated RDMA modules are loaded or operationally used.
- Compare deployed builds with the official CVE record and applicable stable fix commit.
- Review kernel logs for list_add corruption warnings involving rtrs_server, rtrs_core, ib_core, or ib_cm.
- After upgrading, confirm the corrected build is active and monitor normal reconnections for recurring warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21805 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5a79cc9bc961fafe90787f86e8f53ba6fad8d63bCVE reference, Linux
- https://git.kernel.org/stable/c/1af2c769032b6b334cd2a867d7d8c7cbbc527b2dCVE reference, Linux
- https://git.kernel.org/stable/c/81468c4058a62e84e475433b83b3edc613294f5eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.