Security readout for executives and security teams
Plain-English summary
A local user may crash an affected Linux system using the software RDMA over Ethernet component after a specific queue-resize failure. The issue requires local privileges and a reachable RDMA userspace interface; it is not described as remotely exploitable. A successful trigger can disrupt availability, while the supplied CVSS assessment also rates confidentiality and integrity impacts as high.
Executive priority
Prioritize affected multi-user, compute, or RDMA-enabled hosts where untrusted local users can access verbs devices. Patch through supported distribution channels on an accelerated schedule. Internet-facing status alone does not increase exposure because the documented attack vector is local, but a kernel crash could materially interrupt shared workloads.
Technical view
In Linux RDMA/rxe, a failed rxe_queue_resize() can cause rxe_srq_from_attr() to set srq->rq.queue to NULL. A subsequent ibv_modify_srq() call may make rxe_srq_chk_attr() dereference srq->rq.queue->buf->index_mask, causing a kernel NULL-pointer fault. The supplied CVSS 3.1 score is 7.8 with local access, low complexity, low privileges, and no user interaction.
Likely exposure
Exposure is most likely on affected Linux kernels where the RDMA rxe software driver and userspace verbs interface are available to a local low-privileged account. The supplied version data identifies affected Linux releases but does not provide reliable distribution-package mappings. Systems without accessible RDMA/rxe functionality are less likely to be exposed.
Exploitation context
The source bundle does not report known active exploitation, and the CVE is not identified as being in KEV. Triggering requires two successive shared-receive-queue modifications under particular resize-error conditions. Evidence supports a local kernel crash; the bundle does not demonstrate practical code execution, data theft, or remote exploitation.
Researcher notes
The failure is a state-cleanup defect following unsuccessful queue resizing: the queue pointer becomes NULL, but later attribute validation assumes it remains valid. The supplied records provide five stable-kernel commit references, suggesting fixes across maintained branches. Version presentation is incomplete for precise branch boundaries, and no CWE, distribution advisory, proof of exploitation, or exploit evidence is supplied.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check distribution security guidance for corrected package versions and reboot requirements.
- Restrict untrusted local access to RDMA userspace interfaces where operationally feasible.
- Disable unused RDMA/rxe functionality following vendor guidance until patching is complete.
Validation and detection
- Inventory kernel versions and map them to distribution advisories for CVE-2025-68379.
- Determine whether the rdma_rxe driver is installed, loaded, or operationally required.
- Review permissions exposing RDMA userspace verbs devices to local accounts.
- Confirm the running kernel contains the applicable stable commit after remediation.
- Monitor kernel logs for RDMA/rxe NULL dereferences or unexpected system crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68379 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/58aca869babd48cb9c3d6ee9e1452c4b9f5266a6CVE reference, Linux
- https://git.kernel.org/stable/c/b8f6eeb87a76b6fb1f6381b0b2894568e1b784f7CVE reference, Linux
- https://git.kernel.org/stable/c/5dbeb421e137824aa9bd8358bdfc926a3965fc0dCVE reference, Linux
- https://git.kernel.org/stable/c/bc4c14a3863cc0e03698caec9a0cdabd779776eeCVE reference, Linux
- https://git.kernel.org/stable/c/503a5e4690ae14c18570141bc0dcf7501a8419b0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.