RDMA/mlx5: Fix implicit ODP hang on parent deregistration
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP hang on parent deregistration Fix the destroy_unused_implicit_child_mr() to prevent hanging during parent deregistration as of below [1]. Upon entering destroy_unused_implicit_child_mr(), the reference count for the implicit MR parent is incremented using: refcount_inc_not_zero(). A corresponding decrement must be performed if free_implicit_child_mr_work() is not called. The code has been updated to properly manage the reference count that was incremented. [1] INFO: task python3:2157 blocked for more than 120 seconds. Not tainted 6.12.0-rc7+ #1633 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000 Call Trace: __schedule+0x420/0xd30 schedule+0x47/0x130 __mlx5_ib_dereg_mr+0x379/0x5d0 [mlx5_ib] ? __pfx_autoremove_wake_function+0x10/0x10 ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] __x64_sys_ioctl+0x1b0/0xa70 ? kmem_cache_free+0x221/0x40
CVE-2025-21886
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-21886
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7cc8f681f6d4ae4478ae0f60485fc768f2b450da",
"lessThan": "cb96ae783e7249e8e5a50c22952c0bb2983133df",
"versionType": "git"
},
{
"status": "affected",
"version": "edfb65dbb9ffd3102f3ff4dd21316158e56f1976",
"lessThan": "a095ede2daca49d15e74d66d014883f2fa8bb924",
"versionType": "git"
},
{
"status": "affected",
"version": "d3d930411ce390e532470194296658a960887773",
"lessThan": "3d8c6f26893d55fab218ad086719de1fc9bb86ba",
"versionType": "git"
},
{
"status": "affected",
"version": "a306dfff6b76aafa264ad33874a8992a8d5858b7",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.160",
"lessThan": "6.7",
"versionType": "semver"
}
],
"programFiles": [
"drivers/infiniband/hw/mlx5/odp.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12.13",
"lessThan": "6.12.18",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.13.2",
"lessThan": "6.13.6",
"versionType": "semver"
}
],
"programFiles": [
"drivers/infiniband/hw/mlx5/odp.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-21886
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #45951 · Revision 1
- Added to Heist Feed
- Publisher date