CVE-2025-21732

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error

This patch addresses a race condition for an ODP MR that can result in a

CQE with an error on the UMR QP.

During the __mlx5_ib_dereg_mr() flow, the following sequence of calls

occurs:

mlx5_revoke_mr()

mlx5r_umr_revoke_mr()

mlx5r_umr_post_send_wait()

At this point, the lkey is freed from the hardware's perspective.

However, concurrently, mlx5_ib_invalidate_range() might be triggered by

another task attempting to invalidate a range for the same freed lkey.

This task will:

- Acquire the umem_odp->umem_mutex lock.

- Call mlx5r_umr_update_xlt() on the UMR QP.

- Since the lkey has already been freed, this can lead to a CQE error,

causing the UMR QP to enter an error state [1].

To resolve this race condition, the umem_odp->umem_mutex lock is now also

acquired as part of the mlx5_revoke_mr() scope. Upon successful revoke,

we set umem_odp->privat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References