CVE-2025-22091: RDMA/mlx5: Fix page_size variable overflow
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix pagesize variable overflow
Change all variables storing mlx5umemmkcfindbestpgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the pagesize and try to use an mkey with 4GB entity size. The 'unsigned int' pagesize variable will overflow to '0' and we'll hit the WARNON() in alloccacheablemr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloccacheablemr+0x22/0x580 [mlx5ib] Modules linked in: mlx5ib mlx5core bonding ip6gre ip6tunnel tunnel6 ipgre gre rdmarxe rdmaucm ibuverbs ibipoib ibumad rpcrdma ibiser libiscsi scsitransportiscsi rdmacm iwcm ibcm fuse ibcore [last unloaded: mlx5core] CPU: 2 UID: 70878 PID: 1203 Comm: rdmaresourcel Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloccacheablemr+0x22/0x580 [mlx5ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? warn+0x81/0x130 ? alloccacheablemr+0x22/0x580 [mlx5ib] ? reportbug+0xfc/0x1e0 ? handlebug+0x55/0x90 ? excinvalidop+0x17/0x70 ? asmexcinvalidop+0x1a/0x20 ? alloccacheablemr+0x22/0x580 [mlx5ib] createrealmr+0x54/0x150 [mlx5ib] ibuverbsregmr+0x17f/0x2a0 [ibuverbs] ibuverbshandlerUVERBSMETHODINVOKEWRITE+0xca/0x140 [ibuverbs] ibuverbsrunmethod+0x6d0/0x780 [ibuverbs] ? pfxibuverbshandlerUVERBSMETHODINVOKEWRITE+0x10/0x10 [ibuverbs] ibuverbscmdverbs+0x19b/0x360 [ibuverbs] ? walksystemramrange+0x79/0xd0 ? pteoffsetmap+0x1b/0x110 ? pteoffsetmaplock+0x80/0x100 ibuverbsioctl+0xac/0x110 [ibuverbs] x64sysioctl+0x94/0xb0 dosyscall64+0x50/0x110 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIGRAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>
Other sources
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix pagesize variable overflow
Change all variables storing mlx5umemmkcfindbestpgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the pagesize and try to use an mkey with 4GB entity size. The 'unsigned int' pagesize variable will overflow to '0' and we'll hit the WARNON() in alloccacheablemr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloccacheablemr+0x22/0x580 [mlx5ib] Modules linked in: mlx5ib mlx5core bonding ip6gre ip6tunnel tunnel6 ipgre gre rdmarxe rdmaucm ibuverbs ibipoib ibumad rpcrdma ibiser libiscsi scsitransportiscsi rdmacm iwcm ibcm fuse ibcore [last unloaded: mlx5core] CPU: 2 UID: 70878 PID: 1203 Comm: rdmaresourcel Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloccacheablemr+0x22/0x580 [mlx5ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? warn+0x81/0x130 ? alloccacheablemr+0x22/0x580 [mlx5ib] ? reportbug+0xfc/0x1e0 ? handlebug+0x55/0x90 ? excinvalidop+0x17/0x70 ? asmexcinvalidop+0x1a/0x20 ? alloccacheablemr+0x22/0x580 [mlx5ib] createrealmr+0x54/0x150 [mlx5ib] ibuverbsregmr+0x17f/0x2a0 [ibuverbs] ibuverbshandlerUVERBSMETHODINVOKEWRITE+0xca/0x140 [ibuverbs] ibuverbsrunmethod+0x6d0/0x780 [ibuverbs] ? pfxibuverbshandlerUVERBSMETHODINVOKEWRITE+0x10/0x10 [ibuverbs] ibuverbscmdverbs+0x19b/0x360 [ibuverbs] ? walksystemramrange+0x79/0xd0 ? pteoffsetmap+0x1b/0x110 ? pteoffsetmaplock+0x80/0x100 ibuverbsioctl+0xac/0x110 [ibuverbs] x64sysioctl+0x94/0xb0 dosyscall64+0x50/0x110 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIGRAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22091?
CVE-2025-22091 has been classified as a high severity vulnerability due to its potential to cause page size variable overflow.
How do I fix CVE-2025-22091?
To fix CVE-2025-22091, ensure you update to the latest version of the Linux kernel where the vulnerability has been addressed.
What is affected by CVE-2025-22091?
CVE-2025-22091 affects the Linux kernel, specifically components using the RDMA mlx5 driver.
What are the risks associated with CVE-2025-22091?
The risks associated with CVE-2025-22091 include potential system crashes or memory corruption due to page size calculation errors.
Is CVE-2025-22091 exploitable remotely?
There is a potential for CVE-2025-22091 to be exploited remotely depending on the specific configuration and usage of the RDMA functionality.