CVE-2025-21886

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix implicit ODP hang on parent deregistration

Fix the destroy_unused_implicit_child_mr() to prevent hanging during

parent deregistration as of below [1].

Upon entering destroy_unused_implicit_child_mr(), the reference count

for the implicit MR parent is incremented using:

refcount_inc_not_zero().

A corresponding decrement must be performed if

free_implicit_child_mr_work() is not called.

The code has been updated to properly manage the reference count that

was incremented.

[1]

INFO: task python3:2157 blocked for more than 120 seconds.

Not tainted 6.12.0-rc7+ #1633

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:python3 state:D stack:0 pid:2157 tgid:2157 ppid:1685 flags:0x00000000

Call Trace:

<TASK>

__schedule+0x420/0xd30

schedule+0x47/0x130

__mlx5_ib_dereg_mr+0x379/0x5d0 [mlx5_ib]

? __pfx_autoremove_wake_function+0x10/0x10

ib_dereg_mr_user+0x5f/0x120 [ib_co

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References