RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if the firmware command fails which is the last resource to be destroyed some SW resources were already cleaned regardless of the failure. Now properly rollback the object to its original state upon such failure. In order to avoid a use-after free in case someone tries to destroy the object again, which results in the following kernel trace: refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE) CPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G OE ------- --- 6.12.0-54.el10.aarch64 #1 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0xf4/0x148 lr : refcount_warn
CVE-2025-38161
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-38161
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "26d2f662d3a6655a82fd8a287e8b1ce471567f36",
"versionType": "git"
},
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "f9784da76ad7be66230e829e743bdf68a2c49e56",
"versionType": "git"
},
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "cf32affe6f3801cfb72a65e69c4bc7a8ee9be100",
"versionType": "git"
},
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "7c4c84cdcc19e89d42f6bf117238e5471173423e",
"versionType": "git"
},
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "50ac361ff8914133e3cf6ef184bac90c22cb8d79",
"versionType": "git"
},
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "0a7790cbba654e925243571cf2f24d61603d3ed3",
"versionType": "git"
},
{
"status": "affected",
"version": "e2013b212f9f201c71fc5826ce41f39ebece0852",
"lessThan": "5d2ea5aebbb2f3ebde4403f9c55b2b057e5dd2d6",
"versionType": "git"
}
],
"programFiles": [
"drivers/infiniband/hw/mlx5/qpc.c",
"include/linux/mlx5/driver.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.239",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.186",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.142",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.94",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.34",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/infiniband/hw/mlx5/qpc.c",
"include/linux/mlx5/driver.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-38161
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30531 · Revision 1
- Added to Heist Feed
- Publisher date