CVE-2025-22089 – A Linux kernel vulnerability in the RDMA subsys... (How to Fix)

Q: What is the severity of CVE-2025-22089?

CVE-2025-22089 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in the RDMA subsystem allows exposure of hardware counters to non-initial network namespaces, leading to a kernel NULL pointer dereference and system crash when accessed. This affects systems using RDMA (Remote Direct Memory Access) with network namespaces, primarily Linux servers with InfiniBand or RDMA-capable hardware.

📋 TL;DR

A Linux kernel vulnerability in the RDMA subsystem allows exposure of hardware counters to non-initial network namespaces, leading to a kernel NULL pointer dereference and system crash when accessed. This affects systems using RDMA (Remote Direct Memory Access) with network namespaces, primarily Linux servers with InfiniBand or RDMA-capable hardware.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernel versions with commit 467f432a521a up to fixes in stable branches (check specific stable commits for exact ranges).

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires RDMA subsystem enabled and network namespaces in use. Common on systems with InfiniBand hardware like Mellanox mlx4.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting critical services.

🟠

Likely Case

Local denial of service through kernel crash when accessing specific sysfs paths in non-init network namespaces.

🟢

If Mitigated

No impact if network namespaces are not used or access to sysfs is restricted.

🌐 Internet-Facing: LOW - Requires local access to the system and specific commands.

🏢 Internal Only: MEDIUM - Local users or processes in network namespaces can trigger crashes.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires local access and ability to create/use network namespaces. Proof-of-concept commands are provided in the CVE description.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check kernel stable commits: 0cf80f924aec, 6682da5d8fd5, 9a5b7f8842a9, a1ecb30f9085, c14d9704f5d7

Vendor Advisory: https://git.kernel.org/stable/c/0cf80f924aecb5b2bebd4f4ad11b2efc676a0b78

Restart Required: Yes

Instructions:

1. Update Linux kernel to a patched version from your distribution. 2. Reboot the system to load the new kernel.

🔧 Temporary Workarounds

Restrict sysfs access

linux

Limit access to /sys/class/infiniband/ directories to prevent users from triggering the vulnerability.

chmod 700 /sys/class/infiniband/
setfacl -m u:root:rwx /sys/class/infiniband/

Disable network namespaces

linux

Prevent creation of new network namespaces if not required.

sysctl -w kernel.unprivileged_userns_clone=0

🧯 If You Can't Patch

Monitor for crash logs related to hw_stat_device_show or NULL pointer dereferences in RDMA.
Restrict user access to systems with RDMA hardware and network namespace capabilities.

🔍 How to Verify

Check if Vulnerable:

Run: ip netns add test && ip netns exec test cat /sys/class/infiniband/*/hw_counters/* 2>&1 | grep -i 'null\|crash\|bug'

Check Version:

uname -r

Verify Fix Applied:

After patching, repeat the vulnerable command; it should return 'No such file or directory' errors instead of crashing.

📡 Detection & Monitoring

Log Indicators:

Kernel logs with 'BUG: kernel NULL pointer dereference' referencing hw_stat_device_show or ib_core
System crashes or panics after accessing /sys/class/infiniband/

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "hw_stat_device_show" OR "ib_core")

📊 Metadata

CVE ID: CVE-2025-22089

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.13% exploit probability (33th percentile)

Published: April 16, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-22089, you might also want to check these: