Skip to main content

Linux Kernel CVE-2025-68379

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.5 MEDIUM

Local verbs access needed (AV:L, PR:L); a NULL deref causes a kernel crash so A:H only, with no confidentiality or integrity impact, contrary to the feed's C:H/I:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:04 vuln.today
CVE Published
Dec 24, 2025 - 11:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix null deref on srq->rq.queue after resize failure

A NULL pointer dereference can occur in rxe_srq_chk_attr() when ibv_modify_srq() is invoked twice in succession under certain error conditions. The first call may fail in rxe_queue_resize(), which leads rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then triggers a crash (null deref) when accessing srq->rq.queue->buf->index_mask.

Call Trace: <TASK> rxe_modify_srq+0x170/0x480 [rdma_rxe] ? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe] ? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs] ? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs] ib_uverbs_modify_srq+0x204/0x290 [ib_uverbs] ? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs] ? tryinc_node_nr_active+0xe6/0x150 ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs] ? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs] ? __pfx___raw_spin_lock_irqsave+0x10/0x10 ? __pfx_do_vfs_ioctl+0x10/0x10 ? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0 ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 ib_uverbs_ioctl+0x13e/0x220 [ib_uverbs] ? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs] __x64_sys_ioctl+0x138/0x1c0 do_syscall_64+0x82/0x250 ? fdget_pos+0x58/0x4c0 ? ksys_write+0xf3/0x1c0 ? __pfx_ksys_write+0x10/0x10 ? do_syscall_64+0xc8/0x250 ? __pfx_vm_mmap_pgoff+0x10/0x10 ? fget+0x173/0x230 ? fput+0x2a/0x80 ? ksys_mmap_pgoff+0x224/0x4c0 ? do_syscall_64+0xc8/0x250 ? do_user_addr_fault+0x37b/0xfe0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

AnalysisAI

Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).

Technical ContextAI

The flaw lives in the Soft-RoCE (RXE) driver, which implements RDMA over Converged Ethernet entirely in software so that RDMA verbs work without specialized hardware. It is exercised through the ib_uverbs userspace verbs interface (ibv_modify_srq -> ib_uverbs_modify_srq -> rxe_modify_srq). Shared Receive Queues (SRQs) can be resized at runtime; the resize allocates a new backing queue and swaps it in. The root cause is a classic use-after-error NULL dereference (CWE-476, NULL Pointer Dereference - CWE was listed as N/A in the feed): the error path in rxe_srq_from_attr() clears srq->rq.queue to NULL when rxe_queue_resize() fails but leaves the SRQ object usable, so the next attribute-check path reads through the now-NULL queue pointer.

Affected ProductsAI

The Linux kernel's rdma_rxe (Soft-RoCE / RDMA over Ethernet) driver is affected. No CPE strings, exact version ranges, or vendor advisory pages were provided in the feed; affected and fixed versions must be derived from the five kernel.org stable commit references (https://git.kernel.org/stable/c/503a5e4690ae14c18570141bc0dcf7501a8419b0, /58aca869babd48cb9c3d6ee9e1452c4b9f5266a6, /5dbeb421e137824aa9bd8358bdfc926a3965fc0d, /b8f6eeb87a76b6fb1f6381b0b2894568e1b784f7, /bc4c14a3863cc0e03698caec9a0cdabd779776ee), which indicate backports across multiple stable branches. Any kernel that ships the rdma_rxe module and supports SRQ resize prior to these commits should be considered vulnerable.

RemediationAI

Upstream fix available (commit/stable backport); no single tagged release version was provided in the feed, so update to a distribution kernel that incorporates the five referenced kernel.org stable commits (503a5e46, 58aca869, 5dbeb421, b8f6eeb8, bc4c14a3) and consult your distributor's advisory for the exact patched package version. As a compensating control where patching is not immediate, unload or blacklist the Soft-RoCE driver if it is not in use (rmmod rdma_rxe / blacklist rdma_rxe in modprobe.d), which fully removes the attack surface but breaks any software-RDMA workloads; alternatively restrict access to /dev/infiniband uverbs devices so that only trusted users can issue verbs, accepting that legitimate unprivileged RDMA users lose access. Since impact is a local crash, ensuring only trusted local accounts exist on RDMA-enabled hosts also reduces exposure.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-68379 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy