CVE-2025-38582

RDMA/hns: Fix double destruction of rsv_qp

State: Published
Severity: 7.8 High
Published: Aug 19, 2025
Updated: Oct 30, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/hns: Fix double destruction of rsv_qp

rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init().

list_del corruption, ffff589732eb9b50->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 ... Call trace: __list_del_entry_valid+0x148/0x240 hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0x50/0x100 [hclge] process_one_work+0x250/0x9a0 worker_thread+0x324/0x990 kthread+0x190/0x210 ret_from_fork+0x10/0x18

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2ccf1c75d39949d8ea043d04a2e92d7100ea723d to before 5a791715803304bf81ae2a3a278f606e36b82481Affected d2d9c5127122745da6e887f451dd248cfeffca33 to before 067ca15be8b8342931536b66206c496e76864ecfAffected fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before dab173bae3303f074f063750a8dead2550d8c782Affected fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2eaAffected fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before 10b083dbba22be19baa848432b6f25aa68ab2db5Affected fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8Affected dac2723d8bfa9cf5333f477741e6e5fa1ed34645Affected 60595923371c2ebe7faf82536c47eb0c967e3425Affected 6.1.113 to before 6.1.191Affected 6.6.54 to before 6.6.160Affected 6.10.13 to before 6.11Affected 6.11.2 to before 6.12Affected
LinuxLinux	6.12Affected before 6.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.42 through 6.12.Not affected 6.15.10 through 6.15.Not affected 6.16.1 through 6.16.*Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

2ccf1c75d39949d8ea043d04a2e92d7100ea723d to before 5a791715803304bf81ae2a3a278f606e36b82481Affected
d2d9c5127122745da6e887f451dd248cfeffca33 to before 067ca15be8b8342931536b66206c496e76864ecfAffected
fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before dab173bae3303f074f063750a8dead2550d8c782Affected
fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2eaAffected
fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before 10b083dbba22be19baa848432b6f25aa68ab2db5Affected
fd8489294dd2beefb70f12ec4f6132aeec61a4d0 to before c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8Affected
dac2723d8bfa9cf5333f477741e6e5fa1ed34645Affected
60595923371c2ebe7faf82536c47eb0c967e3425Affected
6.1.113 to before 6.1.191Affected
6.6.54 to before 6.6.160Affected
6.10.13 to before 6.11Affected
6.11.2 to before 6.12Affected

LinuxLinux

6.12Affected
before 6.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.42 through 6.12.*Not affected
6.15.10 through 6.15.*Not affected
6.16.1 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.