CVE-2025-22089

A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem. Hardware counter sysfs attributes were unintentionally exposed to non-initial network namespaces. A local user operating within a non-initial network namespace could read these attributes, triggering an invalid pointer dereference that crashes the kernel, resulting in a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access, specific network namespace privileges or container configurations, and the presence of active RDMA hardware, restricting the blast radius to a system crash. Standard enterprise deployments lacking InfiniBand or RDMA devices are unaffected under default conditions. Although an authenticated local user inside an isolated network namespace can trigger a denial of service by reading exposed device performance statistics, the flaw cannot be leveraged remotely and does not compromise system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.