Linux kernel (drivers/infiniband/hw/mlx5): Memory-region deregistration self-deadlocks under memory pressure. An

CVSS 5.5CVE-2025-38373Firmware, BMC & network fabriccurated

Impact

Memory-region deregistration self-deadlocks under memory pressure. An allocation made while holding the page-mapping lock can drive reclaim, which calls back into the same driver's invalidation handler and blocks on the lock it already holds - the tenant's task hangs unkillably and the mlx5 registration path is blocked for everything else on the node.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on mlx5 hardware deregistering an on-demand-paging memory region while the node is under memory pressure. Both halves are tenant-influenceable: the tenant chooses when to deregister and can raise memory pressure itself, which is exactly the condition a busy shared GPU node is already in.

What to do

Update to 6.12.37 / 6.14 or later. Interim: disable on-demand paging for tenant workloads so ODP regions are never created, and keep node memory headroom high enough that reclaim is not entered during RDMA teardown.

References

https://git.kernel.org/stable/c/beb89ada5715e7bd1518c58863eedce89ec051a7 https://git.kernel.org/stable/c/727eb1be65a370572edf307558ec3396b8573156 https://nvd.nist.gov/vuln/detail/CVE-2025-38373

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.