Linux kernel mlx5_ib on-demand paging (ODP): Implicit on-demand-paging memory region destroy work can be queued twice

Impact

Implicit on-demand-paging memory region destroy work can be queued twice, so the second run touches an already-freed MR - a refcount underflow and use-after-free. ODP is what lets RDMA register memory lazily, which is heavily used by large-model training frameworks, so this is reachable from ordinary tenant RDMA registration patterns on a GPU node.

Who can reach it

Local, low-privileged - a tenant process registering and tearing down ODP memory regions through libibverbs.

What to do

Upgrade the host kernel to 6.14 or a stable backport (6.12.13, 6.13.2). Rolling reboot of nodes where ODP is enabled.

References

Related entries

• Linux kernel (vsock): vsock binding not kept until socket destruction - use-after-free, local root with a public exploitCVE-2025-21756 · Linux kernel (vsock)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amdkfd): A correctness defect in the amdkfd (KFD compute driverCVE-2025-21842 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (amdkfd)High
• Linux kernel io_uring: sqe->opcode used unsanitized for table lookups under speculative executionCVE-2025-21863 · Linux kernel io_uring (sqe->opcode speculation sanitization)High
• Linux kernel (drivers/gpu/drm/xe): Xe built its scatter-gather table from HMM page pointers without holding theCVE-2025-21939 · Linux kernel (drivers/gpu/drm/xe)High
• Intel ice driver (Ethernet 800 Series, Linux kernel mode): Kernel-mode flaw in the 800-series Ethernet Linux driver (anCVE-2025-22836 · Intel ice driver (Ethernet 800 Series, Linux kernel mode)High
• Intel ice driver (Ethernet 800 Series, Linux kernel mode): Kernel-mode flaw in the 800-series Ethernet Linux driverCVE-2025-22893 · Intel ice driver (Ethernet 800 Series, Linux kernel mode)High