CVE-2025-38582RDMA/hns: Fix double destruction of rsv_qp
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init(). list_del corruption, ffff589732eb9b50->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 ... Call trace: __list_del_entry_valid+0x148/0x240 hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0x50/0x100 [hclge] process_one_work+0x250/0x9a0 worker_thread+0x324/0x990 kthread+0x190/0x210 ret_from_fork+0x10/0x18
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 21, 2026
- First seen by InfoSec Signals
- Oct 21, 2026
Affected products
Linux Linux linux:linux (from the name) | from d2d9c5127122745da6e887f451dd248cfeffca33 before 067ca15be8b8342931536b66206c496e76864ecf; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before dab173bae3303f074f063750a8dead2550d8c782; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before 10b083dbba22be19baa848432b6f25aa68ab2db5; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8; 2ccf1c75d39949d8ea043d04a2e92d7100ea723d; dac2723d8bfa9cf5333f477741e6e5fa1ed34645; 60595923371c2ebe7faf82536c47eb0c967e3425; and 4 more ranges | CNA record |
linux linux_kernel linux:linux_kernel | from 6.1.113 before 6.2; from 6.6.54 before 6.7; from 6.10.13 before 6.11; from 6.11.2 before 6.12.42; from 6.13 before 6.15.10; from 6.16 before 6.16.1 | NVD |
References
- https://git.kernel.org/stable/c/067ca15be8b8342931536b66206c496e76864ecf
- https://git.kernel.org/stable/c/dab173bae3303f074f063750a8dead2550d8c782patch
- https://git.kernel.org/stable/c/fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2eapatch
- https://git.kernel.org/stable/c/10b083dbba22be19baa848432b6f25aa68ab2db5patch
- https://git.kernel.org/stable/c/c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.