CVE-2025-22085 Overview
CVE-2025-22085 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Remote Direct Memory Access (RDMA) core subsystem. The flaw resides in the device rename code path, where nla_put() in lib/nlattr.c accesses freed slab memory when generating netlink notifications during device registration and rename operations. Syzbot discovered the issue through kernel address sanitizer (KASAN) instrumentation, which reported a slab-use-after-free read of 5 bytes triggered from fill_nldev_handle() in drivers/infiniband/core/nldev.c. A local, authenticated attacker with the ability to issue RDMA netlink commands can trigger the condition to corrupt kernel memory or escalate privileges.
Critical Impact
A local attacker able to issue RDMA netlink operations can leverage the use-after-free to compromise kernel memory integrity, potentially achieving local privilege escalation or kernel-level code execution.
Affected Products
- Linux Kernel (RDMA/core subsystem) prior to fixed stable releases
- Systems using the Soft-RoCE (rxe) driver via rxe_newlink
- Distributions shipping vulnerable kernel builds referenced in the upstream stable commits
Discovery Timeline
- 2025-04-16 - CVE-2025-22085 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-22085
Vulnerability Analysis
The vulnerability lives in the InfiniBand core device management code. When an RDMA device is registered through ib_register_device(), the kernel calls assign_name() which invokes dev_set_name() and kobject_set_name_vargs() to allocate a copy of the device name via kstrdup(). During subsequent operations, the notification path calls rdma_nl_notify_event() and fill_nldev_handle(), which passes the device name into nla_put_string() and ultimately nla_put() in lib/nlattr.c:1099.
The KASAN report shows nla_put() performing a memcpy from a slab region that has already been freed. Because the device name buffer is released while a netlink notification still holds a reference to it, the read of 5 bytes from ffff888140ea1c60 occurs after free. An attacker who races a device rename against a concurrent netlink notification observes stale data or attacker-controlled contents if the slab slot is reallocated.
Root Cause
The root cause is a lifetime mismatch between the RDMA device name allocation and the netlink notification consumers. Renaming the device frees the previous name string, but the notification path continues to reference it. There is no synchronization ensuring the netlink message construction completes before the old name buffer is released.
Attack Vector
Exploitation requires local access and the ability to send RDMA netlink messages, typically requiring CAP_NET_ADMIN. The attacker triggers device creation using rxe_newlink for the Soft-RoCE driver, then races a rename operation against notification generation. Successful exploitation results in reads from freed memory, and heap grooming can convert the primitive into arbitrary kernel memory disclosure or corruption.
No public proof-of-concept exploit is available. The reproducer is embedded within the Syzbot fuzzing harness that originally surfaced the crash.
Detection Methods for CVE-2025-22085
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in nla_put with call stacks including fill_nldev_handle and rdma_nl_notify_event
- Unexpected kernel oops or panic messages originating from drivers/infiniband/core/nldev.c or drivers/infiniband/sw/rxe/
- Unusual invocations of RDMA_NLDEV_CMD_NEWLINK followed rapidly by device rename operations from non-administrative workloads
Detection Strategies
- Audit auditd and kernel logs for processes issuing NETLINK_RDMA sendmsg operations that are not part of expected RDMA management tooling
- Enable KASAN or KFENCE on test kernels to surface use-after-free conditions during pre-production validation
- Correlate rapid sequences of RDMA device creation, renaming, and deletion events on hosts that do not typically host InfiniBand or Soft-RoCE workloads
Monitoring Recommendations
- Monitor loaded kernel modules for the presence of rdma_rxe on systems that do not require Soft-RoCE
- Alert on unexpected CAP_NET_ADMIN usage by non-privileged services or containers
- Track kernel version inventory to identify hosts running kernels prior to the fixed stable releases
How to Mitigate CVE-2025-22085
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits 0d6460b, 1d6a9e7, 56ec858, and edf6b54
- Update to a distribution kernel that includes the RDMA/core rename fix
- Restrict CAP_NET_ADMIN and RDMA netlink access to trusted administrators only
Patch Information
The fix serializes the RDMA device rename operation with netlink notification generation, ensuring the device name buffer is not freed while notification consumers reference it. The relevant upstream commits are available in the stable kernel tree: Linux Kernel Commit 0d6460b, Linux Kernel Commit 1d6a9e7, Linux Kernel Commit 56ec858, and Linux Kernel Commit edf6b54.
Workarounds
- Unload the rdma_rxe kernel module on hosts that do not require Soft-RoCE functionality
- Blocklist the rdma_rxe module using /etc/modprobe.d/ configuration to prevent runtime loading
- Deny NETLINK_RDMA socket access from untrusted user namespaces and containers via seccomp or LSM policies
# Disable the vulnerable Soft-RoCE driver on hosts that do not require RDMA
echo "blacklist rdma_rxe" | sudo tee /etc/modprobe.d/disable-rdma-rxe.conf
sudo rmmod rdma_rxe 2>/dev/null
# Verify the module is no longer loaded
lsmod | grep rdma_rxe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
