Linux kernel mlx5_core eswitch vport QoS scheduling: TENANT ISOLATION: when enabling per-vport QoS fails

CVE-2025-21882Firmware, BMC & network fabricnet/mlx5 vport QoS cleanup on errorcurated

Impact

TENANT ISOLATION: when enabling per-vport QoS fails, the scheduling node is leaked and the pointer left dangling. Per-VF QoS is the mechanism that stops one tenant's VF from starving the others' bandwidth, so failures here both leak host kernel memory and undermine the rate-limiting you sold as an isolation guarantee.

Who can reach it

Local, low-privileged - reached through the VF QoS configuration path on an SR-IOV host. An attacker who can make QoS enablement fail (resource exhaustion, invalid rates) reaches the bad path.

What to do

Upgrade the host kernel to 6.14 or the 6.13.6 stable backport. Rolling reboot of SR-IOV hosts. No firmware flash.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-21882 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2025/CVE-2025-21882.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.