CVE-2025-68379

What it actually does

Null pointer dereference in rxe_srq_chk_attr when srq->rq.queue is set to NULL after a failed rxe_queue_resize during ibv_modify_srq, causing a crash on subsequent access to queue->buf->index_mask.

Why it matters to the business

Kernel crashes and denial of service in RDMA-enabled systems such as high-performance computing or storage clusters, disrupting operations until reboot; widespread kernel presence increases exposure across Linux distributions and container images despite low exploit likelihood.

How an attack unfolds

An attacker with RDMA user-space access invokes ibv_modify_srq twice in quick succession under conditions that cause the first call to fail resize and null the queue pointer, after which the second call dereferences the null pointer inside the rxe driver.

How to fix it

Upgrade the Linux kernel to commit 58aca869babd48cb9c3d6ee9e1452c4b9f5266a6 or later; update affected packages including cert-manager-1.12, cmctl-1.12, cert-manager-acmesolver-1.12, cert-manager-cainjector-1.12, cert-manager-controller-1.12 and cert-manager-webhook-1.12 (and their bitnami-compat variants) to 1.12.16-r7 or newer.

How to confirm the fix worked

Confirm the running kernel contains commit 58aca869babd48cb9c3d6ee9e1452c4b9f5266a6 via git log or package version checks; attempt controlled ibv_modify_srq sequences in a test environment to verify absence of null dereference.

Typical attack path

1. Gain local user access or RDMA permissions on a vulnerable Linux system
2. Load or ensure rdma_rxe module is active
3. Issue ibv_modify_srq calls that trigger rxe_queue_resize failure on first attempt
4. Repeat the modify SRQ operation to trigger null dereference and kernel panic

How to detect it

Search kernel logs and dmesg for oops or panic traces containing rxe_modify_srq, rdma_rxe, ib_uverbs_modify_srq or references to srq->rq.queue; correlate with user-space processes calling RDMA verbs around the time of the crash.

What your security team should do

• Prioritize kernel and package upgrades to the listed fixed versions within the next maintenance window
• Limit untrusted local users from RDMA device access via permissions or cgroups
• Monitor kernel logs for rxe driver oops entries
• Test RDMA workloads after patching to ensure stability