CVE-2025-21885

CVE-2025-21885

High · published March 27, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers

While using nvme target with use_srq on, below kernel panic is noticed.

[ 549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514)

[ 566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI

..

[ 566.393799] <TASK>

[ 566.393807] ? __die_body+0x1a/0x60

[ 566.393823] ? die+0x38/0x60

[ 566.393835] ? do_trap+0xe4/0x110

[ 566.393847] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re]

[ 566.393867] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re]

[ 566.393881] ? do_error_trap+0x7c/0x120

[ 566.393890] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re]

[ 566.393911] ? exc_divide_error+0x34/0x50

[ 566.393923] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re]

[ 566.393939] ? asm_exc_divide_error+0x16/0x20

[ 566.393966] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re]

[ 566.393997] bnxt_qplib_create_srq+0xc9/0x340 [bnxt_re]

[ 566.394040] bnxt_re_create_srq+0x335/0x3b0 [bnxt_re]

[ 566.394057] ? srso_return_thunk+0x5/0x5f

[ 566.394068] ? __init_swait_queue_head+0x4a/0x60

[ 566.394090] ib_create_srq_user+0xa7/0x150 [ib_core]

[ 566.394147] nvmet_rdma_queue_connect+0x7d0/0xbe0 [nvmet_rdma]

[ 566.394174] ? lock_release+0x22c/0x3f0

[ 566.394187] ? srso_return_thunk+0x5/0x5f

Page size and shift info is set only for the user space SRQs.

Set page size and page shift for kernel space SRQs also.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00456 · 38.6th percentile
Published
2025-03-27T19:15Z
Affected products (6)
ProductVersionsFixed in
linux/linux_kernel≥ 5.7, < 6.12.186.12.18
linux/linux_kernel≥ 6.13, < 6.13.66.13.6
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 27 MAR 14:57Z
    RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
    cvelistv5