CVE-2025-22091

A flaw was found in the Linux kernel's mlx5 Remote Direct Memory Access (RDMA) driver. An integer overflow occurs when calculating page sizes during the registration of large, physically contiguous memory regions. A local user could exploit this vulnerability by requesting the registration of large memory areas, triggering unexpected driver errors or system instability that results in a Denial of Service (DoS).

A moderate severity integer overflow flaw was found in the Linux kernel's mlx5 RDMA driver affecting Red Hat Enterprise Linux 9 and 10. When a local user with RDMA access registers a large, physically contiguous memory region (for example, 4 GB), the driver optimizes the page size and attempts to use an mkey with a 4 GB entity size. Because the result of mlx5_umem_mkc_find_best_pgsz() was stored in an unsigned int variable, page size values larger than 31 bits overflow to zero, triggering the WARN_ON() in alloc_cacheable_mr() and causing the memory registration to fail with unexpected driver errors and potential system instability, resulting in a denial of service. Red Hat Enterprise Linux 6, 7, and 8, Red Hat In-Vehicle OS, and Hosted OpenShift Clusters are not affected because the vulnerable code is not present in those offerings. For the affected Red Hat Enterprise Linux 9 and 10 kernel and kernel-rt streams, a fix is being pursued through the standard Red Hat Enterprise Linux update process. Upstream, NIST rates this flaw CVSS 3.1 5.5 (moderate) with availability-only impact, while Red Hat's CVSS 3.1 score of 7.0 additionally considers confidentiality and integrity impacts.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.