Linux kernel (drivers/infiniband/hw/mlx5): The memory-registration engine on the primary AI-cluster NIC wedges

CVSS 5.5CVE-2025-21892Firmware, BMC & network fabriccurated

Impact

The memory-registration engine on the primary AI-cluster NIC wedges permanently. Recovery resets the internal UMR queue-pair without waiting for outstanding work, the firmware discards those completions, and every waiter blocks forever - registration and deregistration stall for all tenants on the node, not just the one that hit the error.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on mlx5 hardware doing normal memory-region register/deregister work; once anything pushes the shared UMR queue-pair into error and recovery runs, the node-wide stall follows. The UMR queue-pair is per-device and shared, so a single tenant's error becomes everyone's outage.

What to do

The fixed-version metadata in this record is unreliable - apply the listed stable fix commits or move to a current stable kernel. Interim: drain workloads off nodes showing hung MR-registration tasks and reboot; there is no runtime way to reset the UMR queue-pair.

References

https://git.kernel.org/stable/c/3e3bf255992cc02404e9d209b127c1c9944239cf https://git.kernel.org/stable/c/1d2b84d8d054313deed2b2fcafe1168bbcb9e99f https://nvd.nist.gov/vuln/detail/CVE-2025-21892

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.