CVE-2025-71084 — RDMA/cm: Fix leaking the multicast GID table reference

Back Back to CVE browser

MEDIUM

RDMA/cm: Fix leaking the multicast GID table reference

Published Jan 13, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.13%

Description

If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN:

GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886

Destroy the ah_attr after canceling the work, it is safe to call this twice.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  5.10.20
  Status
  affected
  Constraints
  <5.10.248
- Version
  5.11.3
  Status
  affected
  Constraints
  <5.12
Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
  -
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.12
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.12
- Version
  5.10.248
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.198
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.160
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.12.64
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.4
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.19
  Status
  unaffected
  Constraints
  <=*
- Version
  6.6.120
  Status
  unaffected
  Constraints
  <=6.6.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
5.10.20	affected	<5.10.248
5.11.3	affected	<5.12

Linux

unaffected

Version	Status	Constraints
	affected
	affected	-
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.12	affected	-
0	unaffected	<5.12
5.10.248	unaffected	<=5.10.*
5.15.198	unaffected	<=5.15.*
6.1.160	unaffected	<=6.1.*
6.12.64	unaffected	<=6.12.*
6.18.4	unaffected	<=6.18.*
6.19	unaffected	<=*
6.6.120	unaffected	<=6.6.*

Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

0.13% 0.00134

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00134

Score over time

Jan–Oct 2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.13% (0.00134)	2.40th	v5 (v2026.06.15)
Jun 15, 2026	0.11% (0.00114)	1.77th	v5 (v2026.06.15)
Jan 14, 2026	0.02% (0.00018)	3.87th	v4 (v2025.03.14)

Weaknesses (0)

No CWE recorded.

References (12)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-71084		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2429037		Issue Tracking
https://git.kernel.org/stable/c/3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5		Patch
https://git.kernel.org/stable/c/57f3cb6c84159d12ba343574df2115fb18dd83ca		Patch
https://git.kernel.org/stable/c/5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3		Patch
https://git.kernel.org/stable/c/ab668a58c4a2ccb6d54add7a76f2f955d15d0196		Patch
https://git.kernel.org/stable/c/abf38398724ecc888f62c678d288da40d11878af		Patch
https://git.kernel.org/stable/c/c0acdee513239e1d6e1b490f56be0e6837dfd162		Patch
https://git.kernel.org/stable/c/d5ce588a9552878859a4d44b70b724216c188a5f		Patch
https://lore.kernel.org/linux-cve-announce/2026011339-CVE-2025-71084-52a2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71084
https://www.cve.org/CVERecord?id=CVE-2025-71084