CVE-2025-22010

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix soft lockup during bt pages loop

Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, it may require a considerable loop count. This will lead to soft lockup:

Add a cond_resched() to fix soft lockup during these loops. In order not to affect the allocation performance of normal-size buffer, set the loop count of a 100GB MR as the threshold to call cond_resched().

Detalles técnicos trazas, registros y código del informe original

        watchdog: BUG: soft lockup - CPU#27 stuck for 22s!
        ...
        Call trace:
         hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]
         hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]
         hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]
         alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]
         hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]
         ib_uverbs_reg_mr+0x118/0x290

        watchdog: BUG: soft lockup - CPU#35 stuck for 23s!
        ...
        Call trace:
         hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]
         mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]
         hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]
         alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]
         hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]
         ib_uverbs_reg_mr+0x120/0x2bc

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 5.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.16%
Percentil entre todas las CVEs puntuadas: 5
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-667

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-22010",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "461eb4ddede266df8f181f578732bb01742c3fd6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "efe544462fc0b499725364f90bd0f8bbf16f861a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "4104b0023ff66b5df900d23dbf38310893deca79",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "975355faba56c0751292ed15a90c3e2c7dc0aad6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "13a52f6c9ff99f7d88f81da535cb4e85eade662b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "9ab20fec7a1ce3057ad86afd27bfd08420b7cd11",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38389eaa4db192648916464b60f6086d6bbaa6de",
              "lessThan": "25655580136de59ec89f09089dd28008ea440fc9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_hem.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.85",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.21",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.13.9",
              "versionType": "semver",
              "lessThanOrEqual": "6.13.*"
            },
            {
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/infiniband/hw/hns/hns_roce_hem.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-04-08T09:15:24.777",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/13a52f6c9ff99f7d88f81da535cb4e85eade662b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/25655580136de59ec89f09089dd28008ea440fc9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4104b0023ff66b5df900d23dbf38310893deca79",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/461eb4ddede266df8f181f578732bb01742c3fd6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/975355faba56c0751292ed15a90c3e2c7dc0aad6",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ab20fec7a1ce3057ad86afd27bfd08420b7cd11",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/efe544462fc0b499725364f90bd0f8bbf16f861a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix soft lockup during bt pages loop\n\nDriver runs a for-loop when allocating bt pages and mapping them with\nbuffer pages. When a large buffer (e.g. MR over 100GB) is being allocated,\nit may require a considerable loop count. This will lead to soft lockup:\n\n        watchdog: BUG: soft lockup - CPU#27 stuck for 22s!\n        ...\n        Call trace:\n         hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2]\n         hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2]\n         hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2]\n         alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2]\n         hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2]\n         ib_uverbs_reg_mr+0x118/0x290\n\n        watchdog: BUG: soft lockup - CPU#35 stuck for 23s!\n        ...\n        Call trace:\n         hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2]\n         mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2]\n         hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2]\n         alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2]\n         hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2]\n         ib_uverbs_reg_mr+0x120/0x2bc\n\nAdd a cond_resched() to fix soft lockup during these loops. In order not\nto affect the allocation performance of normal-size buffer, set the loop\ncount of a 100GB MR as the threshold to call cond_resched()."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/hns: Se corrige el bloqueo suave durante el bucle de páginas bt. El controlador ejecuta un bucle for al asignar páginas bt y mapearlas con páginas de búfer. Al asignar un búfer grande (por ejemplo, un MR de más de 100 GB), puede requerirse un número considerable de bucles. Esto provocará un bloqueo suave: watchdog: BUG: bloqueo suave - ¡CPU n.º 27 bloqueada durante 22 s! ... Rastreo de llamadas: hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2] hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2] hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2] alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2] hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x118/0x290 perro guardián: ERROR: bloqueo suave - ¡CPU n.º 35 bloqueada durante 23 s! ... Seguimiento de llamadas: hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2] mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2] hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2] alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2] hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x120/0x2bc Agregue un cond_resched() para corregir el bloqueo suave durante estos bucles. Para no afectar el rendimiento de asignación de un búfer de tamaño normal, establezca el recuento de bucles de un MR de 100 GB como el umbral para llamar a cond_resched()."
    }
  ],
  "lastModified": "2026-06-17T08:44:50.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63D8EBD5-447E-46E5-A557-067E0CC053F1",
              "versionEndExcluding": "6.1.132",
              "versionStartIncluding": "5.3"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCB56F36-C998-496A-A2E4-D9E0BB3A5BFC",
              "versionEndExcluding": "6.6.85",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B63C450-D73B-4A53-9861-98E25C16E842",
              "versionEndExcluding": "6.12.21",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAECBE4D-58CF-4836-BBAB-5E28B800A778",
              "versionEndExcluding": "6.13.9",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45B90F6B-BEC7-4D4E-883A-9DBADE021750"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1759FFB7-531C-41B1-9AE1-FD3D80E0D920"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD948719-8628-4421-A340-1066314BBD4A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}