CVE-2025-38161
BaseFortify
Publication date: 2025-07-03
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.5 (inc) to 5.10.239 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.186 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.142 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.94 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.34 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.3 (exc) |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's RDMA mlx5 driver during the destruction of a receive queue (RQ). If the firmware command to destroy the RQ fails, some software resources may have already been cleaned up, leading to an inconsistent state. This can cause a use-after-free error if the object is destroyed again, resulting in kernel warnings and potential instability. The fix ensures that the object is properly rolled back to its original state upon such failure to prevent this issue.
How can this vulnerability impact me? :
The vulnerability can lead to a use-after-free condition in the Linux kernel, which may cause kernel crashes, system instability, or unexpected behavior when RDMA resources are destroyed. This could affect systems using the mlx5 driver for RDMA operations, potentially leading to denial of service or other reliability issues.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel warning related to refcount underflow and use-after-free errors in the mlx5_ib module. Detection can be done by monitoring kernel logs for messages such as 'refcount_t: underflow; use-after-free' and warnings from refcount_warn_saturate. You can use commands like 'dmesg | grep refcount' or 'journalctl -k | grep refcount' to check for these kernel warnings. Additionally, monitoring for crashes or unusual behavior in RDMA mlx5 modules may indicate the presence of this issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by properly rolling back the object state upon firmware failure during RQ destruction. Until an update is applied, avoid operations that destroy RQ objects in the mlx5_ib module to prevent triggering the use-after-free condition. Monitoring kernel logs for related warnings can help identify attempts to trigger the vulnerability.