Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-21714— RDMA/mlx5: Fix implicit ODP use after free

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在资源管理错误漏洞，该漏洞源于RDMA_mlx5隐式ODP释放后重用。

CVSS 7.8 · High EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux 5256edcb98a14b11409a2d323f56a70a8b366363< a306dfff6b76aafa264ad33874a8992a8d5858b7 affected
5256edcb98a14b11409a2d323f56a70a8b366363< 7cc8f681f6d4ae4478ae0f60485fc768f2b450da affected
5256edcb98a14b11409a2d323f56a70a8b366363< edfb65dbb9ffd3102f3ff4dd21316158e56f1976 affected
5256edcb98a14b11409a2d323f56a70a8b366363< d3d930411ce390e532470194296658a960887773 affected
5.5 affected
< 5.5 unaffected
6.6.160≤ 6.6.* unaffected
6.12.13≤ 6.12.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-21714

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RDMA/mlx5: Fix implicit ODP use after free
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use after free Prevent double queueing of implicit ODP mr destroy work by using __xa_cmpxchg() to make sure this is the only time we are destroying this specific mr. Without this change, we could try to invalidate this mr twice, which in turn could result in queuing a MR work destroy twice, and eventually the second work could execute after the MR was freed due to the first work, causing a user after free and trace below. refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130 Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs] CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib] RIP: 0010:refcount_warn_saturate+0x12b/0x130 Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff <0f> 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027 RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0 RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019 R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00 R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0 FS: 0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0x12b/0x130 free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib] process_one_work+0x1cc/0x3c0 worker_thread+0x218/0x3c0 kthread+0xc6/0xf0 ret_from_fork+0x1f/0x30 </TASK>
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在资源管理错误漏洞，该漏洞源于RDMA_mlx5隐式ODP释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5256edcb98a14b11409a2d323f56a70a8b366363 ~ a306dfff6b76aafa264ad33874a8992a8d5858b7 -
Linux Linux 5.5 -

II. Public POCs for CVE-2025-21714

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-21714

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-21714 (3)

Same Patch Batch · Linux · 2025-02-27 · 177 CVEs total

CVE-2025-21748 9.8 CRITICAL ksmbd: fix integer overflows on 32 bit systems
CVE-2025-21707 9.8 CRITICAL mptcp: consolidate suboption status
CVE-2025-21796 9.8 CRITICAL nfsd: clear acl_access/acl_default after releasing them
CVE-2025-21805 9.8 CRITICAL RDMA/rtrs: Add missing deinit() call
CVE-2024-58006 9.6 CRITICAL PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
CVE-2024-57999 8.8 HIGH powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW
CVE-2024-57997 8.8 HIGH wifi: wcn36xx: fix channel survey memory allocation size
CVE-2024-57995 8.8 HIGH wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()
CVE-2025-21735 8.8 HIGH NFC: nci: Add bounds checking in nci_hci_create_pipe()
CVE-2025-21710 8.2 HIGH tcp: correct handling of extreme memory squeeze
CVE-2024-57973 8.1 HIGH rdma/cxgb4: Prevent potential integer overflow on 32bit
CVE-2025-21760 8.1 HIGH ndisc: extend RCU protection in ndisc_send_skb()
CVE-2025-21762 8.1 HIGH arp: use RCU protection in arp_xmit()
CVE-2025-21765 8.1 HIGH ipv6: use RCU protection in ip6_default_advmss()
CVE-2025-21766 8.1 HIGH ipv4: use RCU protection in __ip_rt_update_pmtu()
CVE-2025-21801 7.8 HIGH net: ravb: Fix missing rtnl lock in suspend/resume path
CVE-2025-21722 7.8 HIGH nilfs2: do not force clear folio if buffer is referenced
CVE-2024-58003 7.8 HIGH media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()
CVE-2024-58034 7.8 HIGH memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
CVE-2024-54458 7.8 HIGH scsi: ufs: bsg: Set bsg_queue to NULL after removal

Showing top 20 of 177 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-21714

No comments yet

Leave a comment