Security readout for executives and security teams
Plain-English summary
A flaw in the Linux mlx5 RDMA driver can associate a completion event with the wrong queue pair, leading to a kernel null-pointer crash. Systems using mlx5 RDMA are the likely concern, particularly traffic involving queue pairs 0 or 1. The supplied CVSS rating is 8.8, but the public description directly demonstrates a crash rather than data theft or modification.
Executive priority
Treat this as a high-priority availability risk for mlx5 RDMA infrastructure, not an emergency for every Linux system. Rapidly identify exposed RDMA hosts and patch critical systems through supported distribution channels. Escalate where a kernel crash could interrupt storage, clustered computing, or other essential services. Current sources do not support claiming widespread or active attacks.
Technical view
mlx5_poll_one() compares a firmware-supplied CQE queue-pair number against the wrong software field. A false match can preserve an incorrect cur_qp while processing a completion, causing invalid kernel memory access in mlx5_ib_poll_cq(). The correction compares against the firmware-facing mlx5_core_qp number. The issue is especially noticeable for QPs 0 and 1, where the two identifiers differ.
Likely exposure
Exposure is concentrated in Linux systems actively using the mlx5_ib RDMA driver and affected kernels, rather than all Linux hosts. RDMA deployments using queue pairs 0 or 1 appear most susceptible. The supplied version data is ambiguously encoded, so organizations should confirm affected and fixed package versions with their Linux distributor instead of relying on the listed numbers alone.
Exploitation context
The CVSS vector describes adjacent-network reachability, low complexity, no privileges, and no user interaction. However, the bundle contains no KEV listing and no cited evidence of active exploitation or a public exploit. The demonstrated consequence is a kernel null-pointer dereference. Practical reachability and any confidentiality or integrity impact are not established by the supplied description.
Researcher notes
The root cause is an identifier-domain mismatch: the CQE carries a firmware QP number, but the reuse check examined the mlx5_ib_qp number. This can incorrectly retain cur_qp and process a CQE through the wrong object. The trace confirms a supervisor-mode read fault at address 0x12. No CWE is assigned, and the bundle does not establish controlled code execution.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the appropriate linked stable-kernel fix.
- Confirm distributor guidance for affected and fixed package versions before scheduling remediation.
- Prioritize RDMA hosts where mlx5_ib is active, especially availability-critical compute, storage, and network infrastructure.
- Use normal maintenance and reboot procedures so the updated kernel is actually running.
Validation and detection
- Inventory running kernel versions on systems providing mlx5-based RDMA services.
- Confirm whether mlx5_ib and RDMA workloads are active on each candidate host.
- Map each kernel package to distributor advisories or the applicable stable-kernel fix commit.
- After updating and rebooting, verify the running kernel matches the approved fixed package.
- Review kernel logs for mlx5_ib_poll_cq faults, null dereferences, or related crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-22086 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3b97d77049856865ac5ce8ffbc6e716928310f7fCVE reference, Linux
- https://git.kernel.org/stable/c/856d9e5d72dc44eca6d5a153581c58fbd84e92e1CVE reference, Linux
- https://git.kernel.org/stable/c/f0447ceb8a31d79bee7144f98f9a13f765531e1aCVE reference, Linux
- https://git.kernel.org/stable/c/dc7139b7031d877acd73d7eff55670f22f48cd5eCVE reference, Linux
- https://git.kernel.org/stable/c/7c51a6964b45b6d40027abd77e89cef30d26dc5aCVE reference, Linux
- https://git.kernel.org/stable/c/cad677085274ecf9c7565b5bfc5d2e49acbf174cCVE reference, Linux
- https://git.kernel.org/stable/c/55c65a64aefa6267b964d90e9a4039cb68ec73a5CVE reference, Linux
- https://git.kernel.org/stable/c/d52636eb13ccba448a752964cc6fc49970912874CVE reference, Linux
- https://git.kernel.org/stable/c/5ed3b0cb3f827072e93b4c5b6e2b8106fd7cccbdCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.