Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-71084

RDMA/cm: Fix leaking the multicast GID table reference

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.248, 5.12, 5.15.198, 6.1.160, 6.6.120, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN: GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886 Destroy the ah_attr after canceling the work, it is safe to call this twice.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 60d613b39e8d0c9f3b526e9c96445422b4562d76 · fixed in d5ce588a9552878859a4d44b70b724216c188a5f; From fe454dc31e84f8c14cb8942fcb61666c9f40745b · fixed in abf38398724ecc888f62c678d288da40d11878af; From fe454dc31e84f8c14cb8942fcb61666c9f40745b · fixed in ab668a58c4a2ccb6d54add7a76f2f955d15d0196; From fe454dc31e84f8c14cb8942fcb61666c9f40745b · fixed in c0acdee513239e1d6e1b490f56be0e6837dfd162; From fe454dc31e84f8c14cb8942fcb61666c9f40745b · fixed in 5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3; From fe454dc31e84f8c14cb8942fcb61666c9f40745b · fixed in 3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5; From fe454dc31e84f8c14cb8942fcb61666c9f40745b · fixed in 57f3cb6c84159d12ba343574df2115fb18dd83ca; From 5.10.20 · fixed in 5.10.248; From 5.11.3 · fixed in 5.12

  • Linux Linux

    5.12

  • KernelLinux

    fixed in 5.10.248; From 5.11.0 · fixed in 5.15.198; From 5.12.0 · fixed in 6.1.160; From 5.16.0 · fixed in 6.6.120; From 6.2.0 · fixed in 6.12.64; From 6.7.0 · fixed in 6.18.4

References 7

git.kernel.org