CVE-2025-21805
A critical flaw in the Linux kernel's RDMA/rtrs module can corrupt internal data structures when repeatedly connecting and disconnecting RDMA services. The bug occurs because a deinitialization routine was never called, leading to list corruption and potential system instability. The issue has been fixed in a recent kernel patch.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (all distributions using the kernel) prior to the patch that adds the missing deinit() call.
Real-world impact
An attacker could repeatedly establish RDMA connections to corrupt kernel data structures, causing a crash or denial of service on the affected system.
Why this severity
The CVSS score of 9.8 reflects a critical vulnerability that requires no authentication or user interaction; an attacker can exploit it remotely to compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the patch that adds the missing deinit() call (commit 667db86bcbe8).
NVD-referenced vendor advisory
Timeline
- Feb 27, 2025 · Feb 27, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.