Skip to main content

Linux Kernel CVE-2025-68379

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access to rxe-enabled host
  2. Delivery
    Open rdma_rxe device and create SRQ
  3. Exploit
    Call ibv_modify_srq with failing resize (queue set NULL)
  4. Execution
    Issue second modify_srq call
  5. Persist
    NULL deref in rxe_srq_chk_attr
  6. Impact
    Kernel panic / host DoS

Vulnerability Assessment

Exploitation Conditions

Requires local access to a host where the rdma_rxe (Soft-RoCE) kernel module is loaded and the attacker can open an rxe/uverbs device to obtain an SRQ. The specific trigger is calling ibv_modify_srq() twice in succession where the first call requests an SRQ resize that fails inside rxe_queue_resize() (leaving srq->rq.queue = NULL) and the second call then reads srq->rq.queue->buf->index_mask. Limiting factors: exploitation is local only (AV:L), needs low-level privileges/device access (PR:L) sufficient to issue RDMA verbs, requires the two-step failed-resize-then-modify sequence, and is inapplicable if the rdma_rxe module is not loaded or verbs access is restricted to trusted users.
Impact

This is a local, low-privilege denial-of-service issue rather than a remote or memory-corruption threat. The signals are mixed and worth flagging: the supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H, base 7.8) asserts High confidentiality and integrity impact, but the vulnerability class (a NULL pointer dereference/kernel oops) and the feed's own 'Denial Of Service' tag indicate the realistic impact is availability only - the C:H/I:H rating appears inflated and should be treated skeptically. EPSS is very low (0.16%, 6th percentile), it is not on CISA KEV, and no public exploit is identified, all consistent with a niche local-DoS bug requiring an attacker to already have local access and the ability to open an rxe device. Exploitation also depends on first forcing a resize failure and then issuing a second modify call, which raises the practical bar. Overall this is a legitimate stability/robustness fix but a low real-world priority for most environments unless the rxe module is loaded and exposed to untrusted local users.
Exploit ScenarioDerived

A local unprivileged user on a host with the rdma_rxe module loaded opens an rxe device, creates an SRQ, then calls ibv_modify_srq() with a resize request crafted to fail (e.g., an invalid/oversized queue size) so srq->rq.queue is set to NULL. Issuing a second ibv_modify_srq() call then dereferences the NULL queue pointer in the kernel and panics the machine, causing a denial of service. No public proof-of-concept is currently identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).

RemediationAI

Upstream fix available (commit/stable backport); no single tagged release version was provided in the feed, so update to a distribution kernel that incorporates the five referenced kernel.org stable commits (503a5e46, 58aca869, 5dbeb421, b8f6eeb8, bc4c14a3) and consult your distributor's advisory for the exact patched package version. As a compensating control where patching is not immediate, unload or blacklist the Soft-RoCE driver if it is not in use (rmmod rdma_rxe / blacklist rdma_rxe in modprobe.d), which fully removes the attack surface but breaks any software-RDMA workloads; alternatively restrict access to /dev/infiniband uverbs devices so that only trusted users can issue verbs, accepting that legitimate unprivileged RDMA users lose access. Since impact is a local crash, ensuring only trusted local accounts exist on RDMA-enabled hosts also reduces exposure.

Affected ProductsAI

The Linux kernel's rdma_rxe (Soft-RoCE / RDMA over Ethernet) driver is affected. No CPE strings, exact version ranges, or vendor advisory pages were provided in the feed; affected and fixed versions must be derived from the five kernel.org stable commit references (https://git.kernel.org/stable/c/503a5e4690ae14c18570141bc0dcf7501a8419b0, /58aca869babd48cb9c3d6ee9e1452c4b9f5266a6, /5dbeb421e137824aa9bd8358bdfc926a3965fc0d, /b8f6eeb87a76b6fb1f6381b0b2894568e1b784f7, /bc4c14a3863cc0e03698caec9a0cdabd779776ee), which indicate backports across multiple stable branches. Any kernel that ships the rdma_rxe module and supports SRQ resize prior to these commits should be considered vulnerable.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the Soft-RoCE (RXE) driver, which implements RDMA over Converged Ethernet entirely in software so that RDMA verbs work without specialized hardware. It is exercised through the ib_uverbs userspace verbs interface (ibv_modify_srq -> ib_uverbs_modify_srq -> rxe_modify_srq). Shared Receive Queues (SRQs) can be resized at runtime; the resize allocates a new backing queue and swaps it in. The root cause is a classic use-after-error NULL dereference (CWE-476, NULL Pointer Dereference - CWE was listed as N/A in the feed): the error path in rxe_srq_from_attr() clears srq->rq.queue to NULL when rxe_queue_resize() fails but leaves the SRQ object usable, so the next attribute-check path reads through the now-NULL queue pointer.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.5 MEDIUM

Local verbs access needed (AV:L, PR:L); a NULL deref causes a kernel crash so A:H only, with no confidentiality or integrity impact, contrary to the feed's C:H/I:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix null deref on srq->rq.queue after resize failure

A NULL pointer dereference can occur in rxe_srq_chk_attr() when ibv_modify_srq() is invoked twice in succession under certain error conditions. The first call may fail in rxe_queue_resize(), which leads rxe_srq_from_attr() to set srq->rq.queue = NULL. The second call then triggers a crash (null deref) when accessing srq->rq.queue->buf->index_mask.

Call Trace: <TASK> rxe_modify_srq+0x170/0x480 [rdma_rxe] ? __pfx_rxe_modify_srq+0x10/0x10 [rdma_rxe] ? uverbs_try_lock_object+0x4f/0xa0 [ib_uverbs] ? rdma_lookup_get_uobject+0x1f0/0x380 [ib_uverbs] ib_uverbs_modify_srq+0x204/0x290 [ib_uverbs] ? __pfx_ib_uverbs_modify_srq+0x10/0x10 [ib_uverbs] ? tryinc_node_nr_active+0xe6/0x150 ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x2c0/0x470 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ? uverbs_fill_udata+0xed/0x4f0 [ib_uverbs] ib_uverbs_run_method+0x55a/0x6e0 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x54d/0x800 [ib_uverbs] ? __pfx_ib_uverbs_cmd_verbs+0x10/0x10 [ib_uverbs] ? __pfx___raw_spin_lock_irqsave+0x10/0x10 ? __pfx_do_vfs_ioctl+0x10/0x10 ? ioctl_has_perm.constprop.0.isra.0+0x2c7/0x4c0 ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 ib_uverbs_ioctl+0x13e/0x220 [ib_uverbs] ? __pfx_ib_uverbs_ioctl+0x10/0x10 [ib_uverbs] __x64_sys_ioctl+0x138/0x1c0 do_syscall_64+0x82/0x250 ? fdget_pos+0x58/0x4c0 ? ksys_write+0xf3/0x1c0 ? __pfx_ksys_write+0x10/0x10 ? do_syscall_64+0xc8/0x250 ? __pfx_vm_mmap_pgoff+0x10/0x10 ? fget+0x173/0x230 ? fput+0x2a/0x80 ? ksys_mmap_pgoff+0x224/0x4c0 ? do_syscall_64+0xc8/0x250 ? do_user_addr_fault+0x37b/0xfe0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 ? clear_bhb_loop+0x50/0xa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Executive ViewAI

Why It Matters

CVE-2025-68379 affects the Linux kernel's RDMA/rxe driver, enabling a local denial-of-service condition that crashes the kernel when a user manipulates shared receive queue parameters. Organizations running RDMA-based infrastructure for high-performance computing or storage systems face potential uptime loss if local attackers exploit this vulnerability.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict unprivileged user access to RDMA devices; disable rdma_rxe on non-RDMA systems; enforce strict access controls on RDMA-enabled hosts; establish monitoring for patch availability.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs across most server and cloud environments
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/338242 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0447/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0472/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0473/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0587/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20555/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20570/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20599/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20615/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/3733e80e32d1479a8b9bbffffac644068483c720 REF https://git.kernel.org/stable/c/503a5e4690ae14c18570141bc0dcf7501a8419b0 REF https://git.kernel.org/stable/c/58aca869babd48cb9c3d6ee9e1452c4b9f5266a6 REF https://git.kernel.org/stable/c/5dbeb421e137824aa9bd8358bdfc926a3965fc0d REF https://git.kernel.org/stable/c/b8f6eeb87a76b6fb1f6381b0b2894568e1b784f7 REF https://git.kernel.org/stable/c/bc4c14a3863cc0e03698caec9a0cdabd779776ee

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy