CVE-2025-38211

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last

deref") simplified cm_id resource management by freeing cm_id once all

references to the cm_id were removed. The references are removed either

upon completion of iw_cm event handlers or when the application destroys

the cm_id. This commit introduced the use-after-free condition where

cm_id_private object could still be in use by event handler works during

the destruction of cm_id. The commit aee2424246f9 ("RDMA/iwcm: Fix a

use-after-free related to destroying CM IDs") addressed this use-after-

free by flushing all pending works at the cm_id destruction.

However, still another use-after-free possibility remained. It happens

with the work objects allocated for each cm_id_priv within

alloc_work_entries() during cm_id creation, and subsequently freed in

dealloc_work_entries() once all r

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References