Linux kernel (drivers/infiniband/hw/bnxt_re): The NVMe-oF target host panics the moment a client connects.

CVSS 7.5CVE-2025-21885Firmware, BMC & network fabriccurated

Impact

The NVMe-oF target host panics the moment a client connects. Shared-receive-queue page geometry is only filled in for userspace consumers, so a kernel consumer such as nvmet-rdma creates an SRQ with a zero page size and the driver takes a divide-by-zero oops - an immediate whole-node crash triggered from the storage fabric.

Who can reach it

Target-side and reachable from any connecting client: the crash happens in the queue-connect handler, before the NVMe association is established, so no NVMe-level authentication stands in the way. Requires Broadcom bnxt_re HCAs, an exported nvmet-rdma subsystem, and use_srq enabled on the target. If tenants can reach the NVMe-oF listener, any of them can take the storage node down.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: disable use_srq on nvmet-rdma ports (the target works without it), or restrict the NVMe-oF listener to trusted initiator addresses until the node is patched.

References

https://git.kernel.org/stable/c/722c3db62bf60cd23acbdc8c4f445bfedae4498e https://git.kernel.org/stable/c/2cf8e6b52aecb8fbb71c41fe5add3212814031a2 https://nvd.nist.gov/vuln/detail/CVE-2025-21885

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.