CVE-2025-22091— RDMA/mlx5: Fix page_size variable overflow
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mlx5中page_size变量溢出，可能导致内存分配失败。
Affected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | cef7dde8836ab09a3bfe96ada4f18ef2496eacc9< 01fd737776ca0f17a96d83cd7f0840ce130b9a02 |
affected |
cef7dde8836ab09a3bfe96ada4f18ef2496eacc9< e0c09f639ca0e102f250df8787740c2013e9d1b3 |
affected | ||
cef7dde8836ab09a3bfe96ada4f18ef2496eacc9< 05b215d5e219c0228b9c7082ba9bcf176c576646 |
affected | ||
cef7dde8836ab09a3bfe96ada4f18ef2496eacc9< f0c2427412b43cdf1b7b0944749ea17ddb97d5a5 |
affected | ||
6.12 |
affected | ||
< 6.12 |
unaffected | ||
6.12.23≤ 6.12.* |
unaffected | ||
6.13.11≤ 6.13.* |
unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-22091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RDMA/mlx5: Fix page_size variable overflow
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix page_size variable overflow
Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to
unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in
physical memory, the driver will optimize the page_size and try to use
an mkey with 4GB entity size. The 'unsigned int' page_size variable will
overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib]
Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core]
CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib]
Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41
RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246
RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001
RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600
RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000
R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240
R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00
FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
? __warn+0x81/0x130
? alloc_cacheable_mr+0x22/0x580 [mlx5_ib]
? report_bug+0xfc/0x1e0
? handle_bug+0x55/0x90
? exc_invalid_op+0x17/0x70
? asm_exc_invalid_op+0x1a/0x20
? alloc_cacheable_mr+0x22/0x580 [mlx5_ib]
create_real_mr+0x54/0x150 [mlx5_ib]
ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs]
ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs]
ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs]
? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs]
ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs]
? walk_system_ram_range+0x79/0xd0
? ___pte_offset_map+0x1b/0x110
? __pte_offset_map_lock+0x80/0x100
ib_uverbs_ioctl+0xac/0x110 [ib_uverbs]
__x64_sys_ioctl+0x94/0xb0
do_syscall_64+0x50/0x110
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fb7ecf0737b
Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48
RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b
RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003
RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4
R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4
R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150
</TASK>
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mlx5中page_size变量溢出，可能导致内存分配失败。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-22091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-22091
请登录查看更多情报信息。
Other References for CVE-2025-22091 (4)
Same Patch Batch · Linux · 2025-04-16 · 127 CVEs total
| CVE-2025-22021 | 10.0 CRITICAL | netfilter: socket: Lookup orig tuple for IPv6 SNAT |
| CVE-2025-22110 | 9.8 CRITICAL | netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error |
| CVE-2025-22077 | 9.8 CRITICAL | Revert "smb: client: fix TCP timers deadlock after rmmod" |
| CVE-2025-22088 | 9.8 CRITICAL | RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() |
| CVE-2025-22074 | 8.8 HIGH | ksmbd: fix r_count dec/increment mismatch |
| CVE-2025-23133 | 8.8 HIGH | wifi: ath11k: update channel list in reg notifier instead reg worker |
| CVE-2025-22118 | 8.8 HIGH | ice: validate queue quanta parameters to prevent OOB access |
| CVE-2025-22086 | 8.8 HIGH | RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow |
| CVE-2025-22040 | 8.8 HIGH | ksmbd: fix session use-after-free in multichannel connection |
| CVE-2025-22041 | 8.8 HIGH | ksmbd: fix use-after-free in ksmbd_sessions_deregister() |
| CVE-2025-22039 | 8.8 HIGH | ksmbd: fix overflow in dacloffset bounds check |
| CVE-2024-58096 | 8.8 HIGH | wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode |
| CVE-2025-22117 | 8.7 HIGH | ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() |
| CVE-2025-22108 | 8.6 HIGH | bnxt_en: Mask the bd_cnt field in the TX BD properly |
| CVE-2025-22121 | 8.4 HIGH | ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() |
| CVE-2025-22080 | 8.4 HIGH | fs/ntfs3: Prevent integer overflow in hdr_first_de() |
| CVE-2025-22038 | 8.3 HIGH | ksmbd: validate zero num_subauth before sub_auth is accessed |
| CVE-2025-22043 | 8.1 HIGH | ksmbd: add bounds check for durable handle context |
| CVE-2025-22042 | 8.1 HIGH | ksmbd: add bounds check for create lease context |
| CVE-2025-22049 | 7.8 HIGH | LoongArch: Increase ARCH_DMA_MINALIGN up to 16 |
Showing top 20 of 127 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
V. Comments for CVE-2025-22091
No comments yet