CVE-2025-21732: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-21732 addresses a race condition vulnerability in the Linux kernel's RDMA/mlx5 driver. The issue was discovered in January 2025 and affects the memory registration (MR) handling in the mlx5 InfiniBand driver. The vulnerability occurs during the memory deregistration process when dealing with On-Demand Paging (ODP) memory regions (CVE MITRE).

The race condition occurs during the __mlx5_ib_dereg_mr() flow, specifically in the sequence: mlx5_revoke_mr(), mlx5r_umr_revoke_mr(), and mlx5r_umr_post_send_wait(). After the lkey is freed from hardware's perspective, a concurrent mlx5_ib_invalidate_range() operation might attempt to invalidate a range for the same freed lkey. This concurrent operation acquires the umem_odp->umem_mutex lock and calls mlx5r_umr_update_xlt() on the UMR QP, leading to a CQE error and causing the UMR QP to enter an error state (Kernel Git).

When exploited, this vulnerability can result in a Completion Queue Entry (CQE) error on the User Memory Region (UMR) Queue Pair (QP), causing the QP to enter an error state. This can potentially disrupt RDMA operations and affect system stability (Kernel Git).

The vulnerability requires concurrent access to the affected memory region through the RDMA subsystem. It can be triggered during normal system operation when memory deregistration occurs simultaneously with memory invalidation operations (CVE MITRE).

The issue has been fixed by modifying the mlx5_revoke_mr() function to acquire the umem_odp->umem_mutex lock before performing the revocation process. Additionally, after a successful revoke, the fix sets umem_odp->private to NULL, preventing any further invalidation attempts on the freed lkey. The patch has been merged into the mainline kernel (Kernel Git).