High 7.8Published Aug 19, 2025

CVE-2025-38582RDMA/hns: Fix double destruction of rsv_qp

Updated under an hour ago (Oct 29, 2026, 1:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Linux Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init(). list_del corruption, ffff589732eb9b50->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 ... Call trace: __list_del_entry_valid+0x148/0x240 hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0x50/0x100 [hclge] process_one_work+0x250/0x9a0 worker_thread+0x324/0x990 kthread+0x190/0x210 ret_from_fork+0x10/0x18

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 21, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d2d9c5127122745da6e887f451dd248cfeffca33 before 067ca15be8b8342931536b66206c496e76864ecf; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before dab173bae3303f074f063750a8dead2550d8c782; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before 10b083dbba22be19baa848432b6f25aa68ab2db5; from fd8489294dd2beefb70f12ec4f6132aeec61a4d0 before c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8; 2ccf1c75d39949d8ea043d04a2e92d7100ea723d; dac2723d8bfa9cf5333f477741e6e5fa1ed34645; 60595923371c2ebe7faf82536c47eb0c967e3425; and 4 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 6.1.113 before 6.2; from 6.6.54 before 6.7; from 6.10.13 before 6.11; from 6.11.2 before 6.12.42; from 6.13 before 6.15.10; from 6.16 before 6.16.1	NVD

References

References

https://git.kernel.org/stable/c/067ca15be8b8342931536b66206c496e76864ecf
https://git.kernel.org/stable/c/dab173bae3303f074f063750a8dead2550d8c782	patch
https://git.kernel.org/stable/c/fc8b0f5b16bab2e032b4cfcd6218d5df3b80b2ea	patch
https://git.kernel.org/stable/c/10b083dbba22be19baa848432b6f25aa68ab2db5	patch
https://git.kernel.org/stable/c/c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.