Linux kernel (drivers/infiniband/sw/rxe): Two failed shared-receive-queue resizes in a row panic the node. The first

CVSS 7.8CVE-2025-68379Firmware, BMC & network fabriccurated

Impact

Two failed shared-receive-queue resizes in a row panic the node. The first failure leaves the queue pointer null, and the second call dereferences it while validating attributes - a deterministic, unprivileged kernel crash that takes the whole shared host down.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on a node with soft-RoCE (rdma_rxe) loaded: call the standard SRQ-modify verb twice with a size that makes the queue reallocation fail. Entirely tenant-controlled, no race to win, no fabric peer needed. Hardware HCAs do not run this code.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: blacklist/unload rdma_rxe unless soft-RoCE is deliberately in use, and keep /dev/infiniband/* out of containers that do not need verbs.

References

https://git.kernel.org/stable/c/58aca869babd48cb9c3d6ee9e1452c4b9f5266a6 https://git.kernel.org/stable/c/b8f6eeb87a76b6fb1f6381b0b2894568e1b784f7 https://nvd.nist.gov/vuln/detail/CVE-2025-68379

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.