Security readout for executives and security teams
Plain-English summary
CVE-2025-21888 is a Linux kernel RDMA mlx5 driver bug. Deregistering a device-memory region can trigger a kernel warning because the driver tries to unmap DMA memory that was not mapped. The provided sources do not establish data theft, remote compromise, or active exploitation.
Executive priority
Treat this as targeted infrastructure maintenance, not an emergency based on the supplied evidence. Prioritize HPC, storage, virtualization, or low-latency systems using mlx5 RDMA, because kernel WARN behavior may affect reliability depending on local policy and workload.
Technical view
The issue is in the RDMA/mlx5 memory-region deregistration path. DM memory regions have no associated umem, but __mlx5_ib_dereg_mr() can route into mlx5_free_priv_descs() incorrectly and call DMA unmap logic on an unmapped address, producing a WARN in iommu_dma_unmap_page.
Likely exposure
Exposure appears limited to Linux systems using mlx5 RDMA functionality, especially workflows using device-memory memory regions. The source bundle lists Linux kernel affected entries including 5.13, 6.12.18, 6.13.6, and 6.14, but exact distribution impact should be confirmed from vendor kernel advisories.
Exploitation context
The bundle shows no CISA KEV listing and provides no cited evidence of active exploitation. The demonstrated trigger is a local RDMA userspace flow through ib_uverbs during memory-region deregistration, not a remote network exploit.
Researcher notes
Key uncertainty is impact severity. The source text documents a WARN from incorrect DMA unmap handling, but does not provide CVSS, CWE, panic behavior, privilege boundary analysis, or exploitability assessment. Avoid assuming broader kernel compromise without additional evidence.
Mitigation direction
- Apply the relevant Linux stable kernel fix from your distribution or kernel vendor.
- Prioritize hosts with Mellanox mlx5 RDMA hardware or loaded mlx5_ib modules.
- Check vendor advisories for exact fixed package versions before rollout.
- Monitor kernels for WARN messages in RDMA deregistration paths.
Validation and detection
- Inventory Linux hosts running mlx5_core or mlx5_ib RDMA drivers.
- Confirm whether RDMA device-memory workflows are enabled or used.
- Compare running kernel builds against vendor-fixed releases or referenced stable commits.
- Review kernel logs for iommu_dma_unmap_page or mlx5_free_priv_descs warnings.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21888 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0bd34bdd468e93a779c403de3cf7d43ee633b3e0CVE reference, Linux
- https://git.kernel.org/stable/c/f1298cad47ae29828c5c5be77e733ccfcaef6a7fCVE reference, Linux
- https://git.kernel.org/stable/c/abc7b3f1f056d69a8f11d6dceecc0c9549ace770CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.