CVE-2025-22086

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

When cur_qp isn't NULL, in order to avoid fetching the QP from

the radix tree again we check if the next cqe QP is identical to

the one we already have.

The bug however is that we are checking if the QP is identical by

checking the QP number inside the CQE against the QP number inside the

mlx5_ib_qp, but that's wrong since the QP number from the CQE is from

FW so it should be matched against mlx5_core_qp which is our FW QP

number.

Otherwise we could use the wrong QP when handling a CQE which could

cause the kernel trace below.

This issue is mainly noticeable over QPs 0 & 1, since for now they are

the only QPs in our driver whereas the QP number inside mlx5_ib_qp

doesn't match the QP number inside mlx5_core_qp.

BUG: kernel NULL pointer dereference, address: 0000000000000012

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References