Skip to content
Fencer Vulns
medium 5.5

CVE-2025-22091 json

RDMA/mlx5: Fix page_size variable overflow

published 2025-04-16 18 mo ago modified 2026-11-05 3 d ago also EUVD-2025-11195

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix page_size variable overflow

Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow.

For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the page_size and try to use an mkey with 4GB entity size. The 'unsigned int' page_size variable will overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().

WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core] CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x81/0x130 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] ? report_bug+0xfc/0x1e0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] create_real_mr+0x54/0x150 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs] ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs] ? walk_system_ram_range+0x79/0xd0 ? ___pte_offset_map+0x1b/0x110 ? __pte_offset_map_lock+0x80/0x100 ib_uverbs_ioctl+0xac/0x110 [ib_uverbs] __x64_sys_ioctl+0x94/0xb0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>

Patch / fix

  • Linux Linux 6.12.23, 6.13.11, 6.14.2, 6.15
  • linux Debian 14, Debian 13 6.12.25-1

debian advisories DEBIAN-CVE-2025-22091

  • kernel RHEL 9 5.14.0-570.30.1.el9_6
  • rv RHEL 9 5.14.0-570.30.1.el9_6
  • perf RHEL 9 5.14.0-570.30.1.el9_6
  • rtla RHEL 9 5.14.0-570.30.1.el9_6
  • libperf RHEL 9 5.14.0-570.30.1.el9_6
  • kernel-rt RHEL 9 5.14.0-570.30.1.el9_6
  • kernel-64k RHEL 9 5.14.0-570.30.1.el9_6
  • kernel-core RHEL 9 5.14.0-570.30.1.el9_6

red hat advisories RHSA-2025:11861RHSA-2025:11855

  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-rt_debug Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.3.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
  • kernel-syms-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
  • kernel-source-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.20.3.1
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.3.1

suse advisories SUSE-SU-2025:01972-1SUSE-SU-2025:01967-1SUSE-SU-2025:01951-1

  • kernel-abi-stablelists AlmaLinux 10 6.12.0-55.24.1.el10_0
  • kernel AlmaLinux 9 5.14.0-570.30.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.30.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.30.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.30.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.30.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.30.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.30.1.el9_6

almalinux advisories ALSA-2025:11855ALSA-2025:11861

  • kernel Rocky Linux 9 5.14.0-570.30.1.el9_6
  • kernel Rocky Linux 10 6.12.0-55.24.1.el10_0

rocky linux advisories RLSA-2025:11861RLSA-2025:11855

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-22091 updated cvss 7.0

kernel: RDMA/mlx5: Fix page_size variable overflow

  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.30.1.el9_6, perf 5.14.0-570.30.1.el9_6, rtla 5.14.0-570.30.1.el9_6, python3-perf 5.14.0-570.30.1.el9_6, kernel-devel-matched 5.14.0-570.30.1.el9_6, kernel-64k-devel-matched 5.14.0-570.30.1.el9_6, +7 more
    fixed: vendor fix RHSA-2025:11861
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.24.1.el10_0, perf 6.12.0-55.24.1.el10_0, rtla 6.12.0-55.24.1.el10_0, python3-perf 6.12.0-55.24.1.el10_0, kernel-devel-matched 6.12.0-55.24.1.el10_0, kernel-64k-devel-matched 6.12.0-55.24.1.el10_0, +7 more
    fixed: vendor fix RHSA-2025:11855
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.30.1.el9_6, kernel-64k 5.14.0-570.30.1.el9_6, kernel-core 5.14.0-570.30.1.el9_6, kernel-tools 5.14.0-570.30.1.el9_6, kernel-modules 5.14.0-570.30.1.el9_6, kernel-64k-core 5.14.0-570.30.1.el9_6, +27 more
    fixed: vendor fix RHSA-2025:11861
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.24.1.el10_0, kernel-64k 6.12.0-55.24.1.el10_0, kernel-core 6.12.0-55.24.1.el10_0, kernel-tools 6.12.0-55.24.1.el10_0, kernel-modules 6.12.0-55.24.1.el10_0, kernel-64k-core 6.12.0-55.24.1.el10_0, +27 more
    fixed: vendor fix RHSA-2025:11855
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.30.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.30.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.30.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.30.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.30.1.el9_6
    fixed: vendor fix RHSA-2025:11861
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.24.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.24.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.24.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.24.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.24.1.el10_0
    fixed: vendor fix RHSA-2025:11855
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.30.1.el9_6, kernel-rt-64k 5.14.0-570.30.1.el9_6, kernel-rt-core 5.14.0-570.30.1.el9_6, kernel-rt-modules 5.14.0-570.30.1.el9_6, kernel-rt-64k-core 5.14.0-570.30.1.el9_6, kernel-rt-debug-core 5.14.0-570.30.1.el9_6, +14 more
    fixed: vendor fix RHSA-2025:11861
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.24.1.el10_0, kernel-rt-64k 6.12.0-55.24.1.el10_0, kernel-rt-core 6.12.0-55.24.1.el10_0, kernel-rt-modules 6.12.0-55.24.1.el10_0, kernel-rt-64k-core 6.12.0-55.24.1.el10_0, kernel-rt-debug-core 6.12.0-55.24.1.el10_0, +14 more
    fixed: vendor fix RHSA-2025:11855
show 3 more
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.30.1.el9_6, kernel-rt-kvm 5.14.0-570.30.1.el9_6, kernel-rt-core 5.14.0-570.30.1.el9_6, kernel-rt-modules 5.14.0-570.30.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.30.1.el9_6, kernel-rt-debug-core 5.14.0-570.30.1.el9_6, +6 more
    fixed: vendor fix RHSA-2025:11861
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.24.1.el10_0, kernel-rt-kvm 6.12.0-55.24.1.el10_0, kernel-rt-core 6.12.0-55.24.1.el10_0, kernel-rt-modules 6.12.0-55.24.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.24.1.el10_0, kernel-rt-debug-core 6.12.0-55.24.1.el10_0, +6 more
    fixed: vendor fix RHSA-2025:11855
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 d ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.