---
id: CVE-2025-21886
title: 'RDMA/mlx5: Fix implicit ODP hang on parent deregistration'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/mlx5: Fix implicit ODP hang on parent deregistration

  Fix the destroy_unused_implicit_child_mr() to prevent hanging during
  parent deregistration as of below [1].

  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7cc8f681f6d4ae4478ae0f60485fc768f2b450da <
    cb96ae783e7249e8e5a50c22952c0bb2983133df
  - >-
    Linux >= edfb65dbb9ffd3102f3ff4dd21316158e56f1976 <
    a095ede2daca49d15e74d66d014883f2fa8bb924
  - >-
    Linux >= d3d930411ce390e532470194296658a960887773 <
    3d8c6f26893d55fab218ad086719de1fc9bb86ba
  - Linux a306dfff6b76aafa264ad33874a8992a8d5858b7
  - Linux >= 6.6.160 < 6.7
  - Linux >= 6.12.13 < 6.12.18
  - Linux >= 6.13.2 < 6.13.6
published: '2025-03-27'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:36:04.565Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21886'
references:
  - url: 'https://git.kernel.org/stable/c/cb96ae783e7249e8e5a50c22952c0bb2983133df'
  - url: 'https://git.kernel.org/stable/c/a095ede2daca49d15e74d66d014883f2fa8bb924'
  - url: 'https://git.kernel.org/stable/c/3d8c6f26893d55fab218ad086719de1fc9bb86ba'
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15159
ingestedAt: '2026-10-21T12:48:53.716Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mlx5: Fix implicit ODP hang on parent deregistration

Fix the destroy_unused_implicit_child_mr() to prevent hanging during
parent deregistration as of below [1].

Upon entering destroy_unused_implicit_child_mr(), the reference count
for the implicit MR parent is incremented using:
refcount_inc_not_zero().

A corresponding decrement must be performed if
free_implicit_child_mr_work() is not called.

The code has been updated to properly manage the reference count that
was incremented.

[1]
INFO: task python3:2157 blocked for more than 120 seconds.
Not tainted 6.12.0-rc7+ #1633
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:python3         state:D stack:0     pid:2157 tgid:2157  ppid:1685   flags:0x00000000
Call Trace:
<TASK>
__schedule+0x420/0xd30
schedule+0x47/0x130
__mlx5_ib_dereg_mr+0x379/0x5d0 [mlx5_ib]
? __pfx_autoremove_wake_function+0x10/0x10
ib_dereg_mr_user+0x5f/0x120 [ib_core]
? lock_release+0xc6/0x280
destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs]
uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs]
uobj_destroy+0x3f/0x70 [ib_uverbs]
ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs]
? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs]
? lock_acquire+0xc1/0x2f0
? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]
? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs]
? lock_release+0xc6/0x280
ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs]
? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs]
 __x64_sys_ioctl+0x1b0/0xa70
? kmem_cache_free+0x221/0x400
do_syscall_64+0x6b/0x140
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f20f21f017b
RSP: 002b:00007ffcfc4a77c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffcfc4a78d8 RCX: 00007f20f21f017b
RDX: 00007ffcfc4a78c0 RSI: 00000000c0181b01 RDI: 0000000000000003
RBP: 00007ffcfc4a78a0 R08: 000056147d125190 R09: 00007f20f1f14c60
R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffcfc4a7890
R13: 000000000000001c R14: 000056147d100fc0 R15: 00007f20e365c9d0
</TASK>

## Affected

- `Linux >= 7cc8f681f6d4ae4478ae0f60485fc768f2b450da < cb96ae783e7249e8e5a50c22952c0bb2983133df`
- `Linux >= edfb65dbb9ffd3102f3ff4dd21316158e56f1976 < a095ede2daca49d15e74d66d014883f2fa8bb924`
- `Linux >= d3d930411ce390e532470194296658a960887773 < 3d8c6f26893d55fab218ad086719de1fc9bb86ba`
- `Linux a306dfff6b76aafa264ad33874a8992a8d5858b7`
- `Linux >= 6.6.160 < 6.7`
- `Linux >= 6.12.13 < 6.12.18`
- `Linux >= 6.13.2 < 6.13.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.