CVE-2025-22010 Details
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup during bt pages loop Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, it may require a considerable loop count. This will lead to soft lockup: watchdog: BUG: soft lockup - CPU#27 stuck for 22s! ... Call trace: hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2] hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2] hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2] alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2] hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x118/0x290 watchdog: BUG: soft lockup - CPU#35 stuck for 23s! ... Call trace: hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2] mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2] hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2] alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2] hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2] ib_uverbs_reg_mr+0x120/0x2bc Add a cond_resched() to fix soft lockup during these loops. In order not to affect the allocation performance of normal-size buffer, set the loop count of a 100GB MR as the threshold to call cond_resched().
A soft lockup vulnerability has been identified in the Linux kernel's RDMA/hns component. This issue arises when the driver allocates buffer translation (BT) pages and maps them with buffer pages. When dealing with large buffers, such as memory regions (MR) over 100GB, the allocation process can require a significant number of loop iterations. This leads to a soft lockup, where the CPU becomes unresponsive for an extended period. The problem has been traced back to the 'hem_list_alloc_mid_bt' function, part of the 'hns_roce_hw_v2' driver.
The vulnerability has been addressed by adding a 'cond_resched()' call to the loop allocation process. This adjustment allows the system to recover from the soft lockup without significantly impacting the performance of normal-sized buffer allocations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.3, < 6.1.132 >= 6.2, < 6.6.85 >= 6.7, < 6.12.21 >= 6.13, < 6.13.9 6.14 rc1 6.14 rc2 6.14 rc3 6.14 rc4 6.14 rc5 6.14 rc6 6.14 rc7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Nov 3, 2025 | CVE Modified | CVE |
| Apr 10, 2025 | CVE Modified | kernel.org |
| Apr 10, 2025 | Initial Analysis | [email protected] |
| Apr 8, 2025 | New CVE Received | kernel.org |