CVE-2025-21901

In the Linux kernel, the following vulnerability has been resolved:

RDMA/bnxt_re: Add sanity checks on rdev validity

There is a possibility that ulp_irq_stop and ulp_irq_start callbacks will be called when the device is in detached state. This can cause a crash due to NULL pointer dereference as the rdev is already freed.

A NULL pointer dereference flaw was found in the Linux kernel's bnxt_re RDMA driver as shipped in Red Hat Enterprise Linux 9 and 10. When a device is in a detached state and its rdev structure has already been freed, the ulp_irq_stop and ulp_irq_start callbacks can still be invoked, causing a kernel crash (local denial of service). Red Hat Enterprise Linux 9 and 10 are affected and the fix is currently deferred for these releases given the low impact of the flaw; the residual risk is that a highly privileged local user on a system using affected bnxt_re RDMA hardware could crash the kernel, resulting in denial of service. Red Hat Enterprise Linux 6 and 8, and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those releases, and Red Hat Enterprise Linux 7 is out of support scope. This flaw affects only availability, which is why Red Hat scores it 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, Low) versus NIST's 5.5; the CVEORG score of 7.8, which includes confidentiality and integrity impacts, does not match the nature of this NULL pointer dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.