CVE-2025-22091 is a vulnerability identified in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem, specifically within the Mellanox mlx5 InfiniBand driver (mlx5_ib). The flaw arises from an integer overflow in the handling of the page_size variable used during memory registration for RDMA operations. The mlx5_umem_mkc_find_best_pgsz() function returns a page size value that was originally stored in an 'unsigned int' variable, which is insufficient to hold values larger than 31 bits. When attempting to register a large contiguous physical memory region (e.g., 4GB), the page_size variable overflows to zero, triggering a WARN_ON() kernel warning in the alloc_cacheable_mr() function. This results in an invalid operation exception and potential kernel instability or crash. The root cause is the improper data type size for page_size, which was fixed by changing the variable to 'unsigned long' to accommodate larger values and prevent overflow. The vulnerability is located in the mlx5_ib kernel module, which is responsible for managing RDMA memory regions on Mellanox hardware. The kernel stack trace shows that the issue occurs during the creation of memory keys (mkeys) for RDMA memory registration, which is critical for high-performance networking in data centers and HPC environments. Although no known exploits are currently in the wild, the vulnerability could be triggered by a local user or process with RDMA privileges attempting to register large memory regions, potentially causing denial of service (DoS) through kernel crashes or instability. The vulnerability does not appear to allow privilege escalation or arbitrary code execution directly but poses a risk to system availability and reliability in environments using Mellanox RDMA hardware with affected Linux kernel versions. The fix involves ensuring all variables storing the page size are of type 'unsigned long' to prevent overflow and maintain correct operation during memory registration.

For European organizations, particularly those operating data centers, HPC clusters, or cloud infrastructure utilizing Linux servers with Mellanox RDMA hardware, this vulnerability could lead to system crashes or instability when handling large RDMA memory registrations. This may result in denial of service conditions affecting critical applications relying on high-speed RDMA networking, such as financial trading platforms, scientific computing, and large-scale virtualization environments. The impact is primarily on availability and operational continuity. Since RDMA is often used in performance-sensitive environments, any disruption could cause significant downtime and financial loss. Additionally, organizations with strict uptime requirements or those providing RDMA-enabled services may face reputational damage if affected by this vulnerability. However, the vulnerability requires local access and RDMA privileges, limiting the attack surface to trusted users or processes. Remote exploitation is unlikely without prior access. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to accidental or malicious triggering of the overflow condition.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched, ensuring the mlx5_ib driver uses 'unsigned long' for page_size variables. Specifically, kernel updates from the Linux vendor or distribution that address CVE-2025-22091 must be applied promptly. System administrators should audit RDMA usage and restrict access to RDMA device nodes and interfaces to trusted users only, minimizing the risk of accidental or malicious triggering. Implementing strict access controls and monitoring RDMA-related system calls can help detect anomalous behavior. For environments where immediate patching is not feasible, disabling RDMA support or the mlx5_ib driver temporarily may be considered to mitigate risk, though this will impact RDMA functionality. Additionally, organizations should monitor kernel logs for WARN_ON() messages related to alloc_cacheable_mr() as indicators of attempted exploitation or misconfiguration. Incorporating these mitigations into change management and vulnerability management processes will help maintain system stability and security.