CVE-2025-21882
Description
From CVE.org
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix vport QoS cleanup on error When enabling vport QoS fails, the scheduling node was never freed, causing a leak. Add the missing free and reset the vport scheduling node pointer to NULL.
Statement
A low-impact memory leak flaw was found in the Linux kernel's mlx5 core driver (drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c) in the SR-IOV e-switch vport QoS handling. When enabling vport QoS fails, the allocated vport scheduling element (scheduling node) was never freed, leaking kernel memory on each failed enablement. A local user with the privileges required to configure vport QoS could repeatedly trigger this failing path to gradually exhaust kernel memory, resulting in resource exhaustion and a denial of service, with no impact on confidentiality or integrity. Red Hat Product Security rates this flaw Low severity (CVSS 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) because exploitation requires local privileged access, the leak only occurs in an error path, and the impact is limited to availability. This differs significantly from the upstream CVEORG CVSS score of 7.8 (Important, reflecting high confidentiality, integrity, and availability impact), which does not correspond to the nature of this error-path memory leak, and from the NIST score of 5.5 (Moderate), which assumes high availability impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected because the vulnerable code, introduced upstream in Linux kernel 6.13, is not present in the shipped Red Hat kernels, so no update is required for Red Hat customers.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | 5.5 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | High |
| Integrity Impact | None | None | High |
| Availability Impact | Low | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
