CVE-2025-21662

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix variable not being completed when function returns

When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task which issued the command may hang:

mlx5_core 0000:01:00.0: cmd_work_handler:877:(pid 3880418): failed to allocate command entry INFO: task kworker/13:2:4055883 blocked for more than 120 seconds. Not tainted 4.19.90-25.44.v2101.ky10.aarch64 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/13:2 D 0 4055883 2 0x00000228 Workqueue: events mlx5e_tx_dim_work [mlx5_core] Call trace: __switch_to+0xe8/0x150 __schedule+0x2a8/0x9b8 schedule+0x2c/0x88 schedule_timeout+0x204/0x478 wait_for_common+0x154/0x250 wait_for_completion+0x28/0x38 cmd_exec+0x7a0/0xa00 [mlx5_core] mlx5_cmd_exec+0x54/0x80 [mlx5_core] mlx5_core_modify_cq+0x6c/0x80 [mlx5_core] mlx5_core_modify_cq_moderation+0xa0/0xb8 [mlx5_core] mlx5e_tx_dim_work+0x54/0x68 [mlx5_core] process_one_work+0x1b0/0x448 worker_thread+0x54/0x468 kthread+0x134/0x138 ret_from_fork+0x10/0x18

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 4baae687a20ef2b82fde12de3c04461e6f2521d6, < f0a2808767ac39f64b1d9a0ff865c255073cf3d4; >= f9caccdd42e999b74303c9b0643300073ed5d319, < 229cc10284373fbe754e623b7033dca7e7470ec8; >= 485d65e1357123a697c591a5aeb773994b247ad7, < 36124081f6ffd9dfaad48830bdf106bb82a9457d; >= 485d65e1357123a697c591a5aeb773994b247ad7, < 0e2909c6bec9048f49d0c8e16887c63b50b14647; 2d0962d05c93de391ce85f6e764df895f47c8918; 94024332a129c6e4275569d85c0c1bfb2ae2d71b; >= 6.1.93, < 6.1.125; >= 6.6.33, < 6.6.72; >= 6.8.12, < 6.9; >= 6.9.3, < 6.10
LinuxLinux6.10

References

Timeline

Published
Jan 21, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-216635.5In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree NvidiaCVE-2025-216645.5In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The docuCVE-2025-216655.5In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, CVE-2025-216665.5In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reCVE-2025-216675.5In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kerneCVE-2025-216685.5In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently CVE-2025-216695.5In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket hCVE-2025-21675.4The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions uCVE-2025-216705.5In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core CVE-2025-216717.8In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early,CVE-2025-216725.5In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a locCVE-2025-216735.5In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shuttin
CVE-2025-21662: Medium severity, CVSS 5.5 | Vulnix