CVE-2025-21882

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21882
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix vport QoS cleanup on error When enabling vport QoS fails, the scheduling node was never freed, causing a leak. Add the missing free and reset the vport scheduling node pointer to NULL.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/7f3528f7d2f98b70e19a6bb7b130fc82c079ac54 Patch
https://git.kernel.org/stable/c/fead368502bce0e10bea7c0d2895b2fa0c6c10aa Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
History

29 Oct 2025, 16:56

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: Se corrige la limpieza de QoS de vport en caso de error. Al fallar la habilitación de QoS de vport, el nodo de programación nunca se liberaba, lo que causaba una fuga. Agregue la liberación faltante y restablezca el puntero del nodo de programación de vport a NULL.
CWE CWE-401
References () https://git.kernel.org/stable/c/7f3528f7d2f98b70e19a6bb7b130fc82c079ac54 - () https://git.kernel.org/stable/c/7f3528f7d2f98b70e19a6bb7b130fc82c079ac54 - Patch
References () https://git.kernel.org/stable/c/fead368502bce0e10bea7c0d2895b2fa0c6c10aa - () https://git.kernel.org/stable/c/fead368502bce0e10bea7c0d2895b2fa0c6c10aa - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

27 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 15:15

Updated : 2025-10-29 16:56

NVD link : CVE-2025-21882

Mitre link : CVE-2025-21882

CVE.ORG link : CVE-2025-21882

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime