CVE-2025-21892

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix the recovery flow of the UMR QP

This patch addresses an issue in the recovery flow of the UMR QP,

ensuring tasks do not get stuck, as highlighted by the call trace [1].

During recovery, before transitioning the QP to the RESET state, the

software must wait for all outstanding WRs to complete.

Failing to do so can cause the firmware to skip sending some flushed

CQEs with errors and simply discard them upon the RESET, as per the IB

specification.

This race condition can result in lost CQEs and tasks becoming stuck.

To resolve this, the patch sends a final WR which serves only as a

barrier before moving the QP state to RESET.

Once a CQE is received for that final WR, it guarantees that no

outstanding WRs remain, making it safe to transition the QP to RESET and

subsequently back to RTS, restoring proper functionality.

Note:

For the barrier WR, we simply reuse the failed and ready WR.

Since the QP is

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References