Linux kernel (drivers/infiniband/hw/mlx5): Memory-region deregistration hangs forever on the flagship AI-cluster NIC. A

CVSS 5.5CVE-2025-21886Firmware, BMC & network fabriccurated

Impact

Memory-region deregistration hangs forever on the flagship AI-cluster NIC. A reference taken on the parent region is never dropped, so the deregister call blocks in uninterruptible sleep - the task cannot be killed, it holds device references that prevent teardown, and the tenant's GPU job wedges without releasing its RDMA resources back to the node.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on mlx5 hardware with on-demand paging (implicit ODP) in use - deregistering a parent MR that still has implicit children is enough, which is normal application shutdown behaviour and therefore trivially repeatable. Only applies where ODP is enabled; non-ODP registrations do not reach this path.

What to do

Update to 6.12.18 / 6.13.6 or later. Interim: disable on-demand paging for tenant workloads (do not advertise ODP capability) so implicit MRs are never created, and drain jobs off nodes that have accumulated stuck deregistration tasks.

References

https://git.kernel.org/stable/c/cb96ae783e7249e8e5a50c22952c0bb2983133df https://git.kernel.org/stable/c/a095ede2daca49d15e74d66d014883f2fa8bb924 https://nvd.nist.gov/vuln/detail/CVE-2025-21886

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.