Linux Kernel CVE-2025-22088

Patch available per vendor advisory - upgrade to a kernel build that includes the fix. Apply your distribution's patched kernel: SUSE users should install the updates from the referenced SUSE-SU-2025 advisories (e.g. https://www.suse.com/support/update/SUSE-SU-2025:01614/), and Debian LTS users should follow https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html; users building from source should take a stable kernel containing commits 667a628ab67d/78411a133312/7aa6bb5276d9/83437689249e/a114d25d584c/bc1db4d8f1b0 from git.kernel.org, then reboot into the new kernel to activate it. Exact upstream fix versions are not enumerated in the input beyond these commit hashes, so confirm the precise released kernel version against your distro's changelog. Where immediate patching is not possible, the most effective compensating control is to avoid loading the vulnerable code: if erdma is not required, blacklist/unload the module (e.g. prevent the erdma module from loading) - trade-off is loss of Elastic RDMA functionality on affected instances. Additionally restrict which peers can initiate RDMA connections to the host (network/security-group segmentation of the RDMA fabric) to shrink the reachable attack surface; trade-off is reduced connectivity for legitimate RDMA clients.