CVE-2025-22010

What it actually does

Long-running for-loops in RDMA/hns hem_list_alloc_mid_bt and related functions during allocation and mapping of very large buffers (MRs exceeding 100 GB) prevent the scheduler from running, triggering soft lockups on affected CPUs.

Why it matters to the business

Systems performing large RDMA memory registrations can experience prolonged unresponsiveness or forced reboots, disrupting high-performance storage, networking, or compute workloads; low immediate risk given absence from KEV and flat low EPSS.

How an attack unfolds

An attacker with local access registers an extremely large memory region through the RDMA user verbs interface; the driver enters the allocation path in hns_roce_mtr_create / alloc_mr_pbl, executes thousands of iterations without calling cond_resched, and the watchdog fires a soft lockup.

How to fix it

Upgrade affected Samba packages on Red Hat storage:3.5:samba:el8 to the listed fixed versions (0:4.16.5-100.el8rhgs or newer) and ensure the underlying kernel includes the cond_resched() change; schedule the update before any large MR workloads are exercised.

How to confirm the fix worked

Confirm package versions match the fixed releases, verify that large MR allocation tests complete without soft-lockup watchdog messages, and check kernel logs for absence of the hem_list_alloc_mid_bt or hns_roce_hem_list_find_mtt stack traces under heavy RDMA load.

Typical attack path

1. Obtain local user privileges on a system using the hns_roce_hw_v2 driver
2. Issue an ibv_reg_mr call requesting a memory region larger than 100 GB
3. Driver enters hem_list_alloc_mid_bt or hns_roce_hem_list_find_mtt loop
4. Watchdog detects CPU stuck for >20 s and logs soft lockup
5. System may become unresponsive or trigger panic depending on configuration

How to detect it

Search kernel logs for watchdog soft lockup entries containing hem_list_alloc_mid_bt, hns_roce_hem_list_request, hns_roce_mtr_create, or alloc_mr_pbl; correlate with user-space processes calling ib_uverbs_reg_mr during periods of high RDMA activity.

What your security team should do

• Apply the listed Samba package updates immediately on all Red Hat storage:3.5:samba:el8 systems
• Add monitoring for soft-lockup watchdog messages involving hns_roce_hw_v2 symbols
• Test large MR allocation workloads in a staging environment after patching
• Review any downstream kernel or RDMA-dependent packages for similar loop patterns