Linux kernel (drivers/infiniband/ulp/rtrs): A remote client corrupts kernel linked lists on the RDMA block-storage

CVSS 9.8CVE-2025-21805Firmware, BMC & network fabriccurated

Impact

A remote client corrupts kernel linked lists on the RDMA block-storage server. An IB event handler is registered on every connection but never unregistered, so repeated connect/disconnect cycles leave stale handlers linked into device-wide lists - list corruption and stale-pointer execution on the target host, rated critical and network-reachable by the kernel CNA.

Who can reach it

Target-side and pre-authentication: whoever can reach the rtrs/rnbd server's listener drives it, entirely from the connection-establishment path (the CM request handler). Repeat connect/disconnect is the whole exploit. Applies to nodes exporting storage over rtrs/rnbd - if that listener is reachable from tenant networks, treat it as tenant-reachable.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: firewall the rtrs/rnbd server port to the storage network only, or stop exporting rtrs targets on affected hosts until patched.

References

https://git.kernel.org/stable/c/5a79cc9bc961fafe90787f86e8f53ba6fad8d63b https://git.kernel.org/stable/c/1af2c769032b6b334cd2a867d7d8c7cbbc527b2d https://nvd.nist.gov/vuln/detail/CVE-2025-21805

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.