CVE-2025-22086 is a vulnerability identified in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically within the Mellanox mlx5 driver component. The issue arises in the function mlx5_poll_one(), which is responsible for polling completion queue entries (CQEs) and updating the current queue pair (cur_qp) state. The vulnerability stems from an incorrect comparison logic where the QP (queue pair) number extracted from the CQE, which originates from firmware (FW), is compared against the QP number stored in mlx5_ib_qp, a software structure that does not correspond to the firmware's QP numbering scheme. The correct comparison should be against mlx5_core_qp, which holds the FW QP number. This mismatch can lead to the driver using an incorrect QP when processing CQEs, resulting in a NULL pointer dereference and consequent kernel oops (crash). The bug is particularly evident with QPs 0 and 1, which are the only QPs currently handled by the driver, where the discrepancy between mlx5_ib_qp and mlx5_core_qp QP numbers is present. The kernel crash manifests as a supervisor read access fault due to dereferencing a NULL pointer, causing a denial of service (DoS) condition on affected systems. The vulnerability affects specific Linux kernel versions identified by the commit hash e126ba97dba9edeb6fafa3665b5f8497fc9cdf8c and was publicly disclosed on April 16, 2025. No known exploits are reported in the wild at this time, and no CVSS score has been assigned. The issue is technical and low-level, impacting the stability and reliability of systems using the mlx5 RDMA driver, which is common in high-performance computing and data center environments relying on Mellanox hardware for RDMA capabilities.

For European organizations, the impact of CVE-2025-22086 can be significant, particularly for enterprises and research institutions that utilize Linux servers with Mellanox RDMA-enabled network interfaces. These environments often include data centers, cloud service providers, and HPC clusters where RDMA is leveraged for low-latency, high-throughput networking. The kernel crash caused by this vulnerability results in denial of service, potentially disrupting critical applications and services dependent on RDMA communication. This can lead to downtime, loss of productivity, and increased operational costs due to system instability and required reboots. While the vulnerability does not directly lead to privilege escalation or data leakage, the availability impact alone is critical for sectors such as finance, telecommunications, and scientific research, where continuous uptime is essential. Additionally, the complexity of the bug and its manifestation in kernel space may complicate incident response and recovery efforts. Given the absence of known exploits, the immediate risk is moderate, but the potential for future exploitation exists if attackers develop methods to trigger the NULL pointer dereference remotely or via crafted workloads.

Mitigation of CVE-2025-22086 requires applying the official Linux kernel patches that correct the QP number comparison logic in the mlx5 driver. Organizations should prioritize updating to the fixed kernel versions or backporting the patch to their supported kernel branches. Given the kernel-level nature of the vulnerability, kernel updates should be tested in staging environments to ensure compatibility and stability before deployment in production. Additionally, organizations should audit their use of RDMA and Mellanox hardware to identify affected systems. Where immediate patching is not feasible, temporarily disabling RDMA functionality or restricting access to RDMA interfaces can reduce exposure. Monitoring kernel logs for oops or crashes related to mlx5_ib_poll_cq can help detect attempts to trigger the vulnerability. Network segmentation and strict access controls around RDMA-enabled hosts can further limit potential attack vectors. Finally, maintaining an up-to-date inventory of Linux kernel versions and hardware drivers will facilitate timely response to future vulnerabilities in this critical subsystem.