CVE-2025-38211
BaseFortify
Publication date: 2025-07-04
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.8 (inc) to 5.4.296 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.240 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.186 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.142 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.95 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.35 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.15.4 (exc) |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's RDMA iwcm component. It occurs when work objects related to connection management IDs (cm_id) are freed while still potentially in use by event handler work functions. Specifically, if the last reference to a cm_id is decremented during an event handler work, the associated work object can be freed prematurely, leading to a use-after-free condition that can cause kernel bugs or crashes.
How can this vulnerability impact me? :
This vulnerability can cause kernel crashes or instability due to use-after-free bugs in the RDMA connection management code. Such crashes can lead to denial of service or system instability, especially on systems using RDMA networking features. It may also potentially be exploited to execute arbitrary code or escalate privileges, although the description does not explicitly confirm exploitation beyond causing kernel bugs.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a use-after-free bug in the Linux kernel related to RDMA/iwcm work objects, which can be detected by observing kernel BUG messages such as KASAN slab-use-after-free errors in the kernel logs. You can check for these errors by examining the kernel log with commands like 'dmesg | grep -i kasan' or 'journalctl -k | grep -i kasan'. Additionally, reproducing the bug is possible by running the blktests test case nvme/061 for the rdma transport and the siw driver, which may help in detection.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the last reference to the cm_id is decremented not in the event handler works but in the cm_id destruction context. This prevents the use-after-free of cm_id_private work objects. Applying the patch that flushes all pending works at cm_id destruction and avoids freeing work objects prematurely is necessary. Until the patch is applied, avoid workloads or test cases that trigger the bug, such as the nvme/061 blktests test case for rdma transport and siw driver.