CVE-2025-22089 is a vulnerability in the Linux kernel related to the RDMA (Remote Direct Memory Access) core subsystem, specifically concerning the exposure of hardware counters (hw_counters) outside the initial network namespace (init net namespace). The vulnerability arises from a commit (467f432a521a) that split port and device counter sysfs attributes but inadvertently allowed partial exposure of hw_counters to non-init network namespaces. Although attempts to read these counters outside the init namespace cause a kernel crash due to a NULL pointer dereference, the root cause is improper handling of device pointers in the hw_stat_device_show() function. This function incorrectly casts a device pointer to an ib_device pointer using container_of(), leading to memory corruption and a kernel panic. The issue can be reproduced by creating a new network namespace and attempting to read the hw_counters sysfs entries for an Infiniband device, which triggers the crash. The underlying problem is that hw_counters should never be accessible outside the init net namespace, as these counters are sensitive kernel objects tied to device state. The fix involves saving the index of the corresponding attribute group during initialization and zeroing the pointer to the hw_counters group for compatibility devices, preventing their exposure in non-init namespaces. This vulnerability affects Linux kernel versions containing the specified commit and impacts systems using RDMA-capable Infiniband devices. While no known exploits are reported in the wild, the flaw can cause denial of service (kernel panic) when triggered, potentially impacting system stability and availability.

For European organizations, this vulnerability poses a risk primarily to environments running Linux kernels with the affected commit and utilizing RDMA-capable hardware, such as Infiniband devices, which are common in high-performance computing (HPC), data centers, and enterprise networking infrastructure. The vulnerability can be exploited to cause a denial of service by crashing the kernel when an unprivileged user or process in a non-init network namespace attempts to access the hw_counters sysfs entries. This could disrupt critical services, especially in sectors relying on stable and high-throughput networking, such as financial services, research institutions, telecommunications, and cloud providers. Although the vulnerability does not appear to allow privilege escalation or remote code execution, the resulting kernel panic could lead to downtime, data loss, or interruption of sensitive operations. Additionally, multi-tenant environments using network namespaces for containerization or virtualization could be affected if untrusted tenants trigger the vulnerability, impacting service availability and potentially leading to cascading failures in shared infrastructure.

European organizations should apply the Linux kernel patch that addresses this vulnerability by properly restricting access to hw_counters outside the init network namespace. Specifically, system administrators should: 1) Identify and update all Linux systems running affected kernel versions containing commit 467f432a521a or later versions that include the fix. 2) Audit usage of network namespaces and RDMA hardware to ensure that unprivileged users or containers do not have access to sensitive sysfs entries related to hw_counters. 3) Implement strict access controls and namespace isolation policies to prevent unauthorized access to kernel device attributes. 4) Monitor kernel logs for signs of NULL pointer dereferences or kernel panics related to ib_core or hw_counters to detect attempted exploitation. 5) For environments where immediate patching is not feasible, consider disabling RDMA hardware or restricting access to Infiniband devices until the patch can be applied. 6) Engage with hardware and Linux distribution vendors to ensure timely receipt of security updates and verify that kernel versions in use include the fix. These steps go beyond generic advice by focusing on the specific subsystem and usage patterns that expose the vulnerability.