CVE-2025-22088: Linux Kernel Use-After-Free Vulnerability

CVE-2025-22088 Overview

CVE-2025-22088 is a use-after-free vulnerability [CWE-416] in the Linux kernel's RDMA/erdma driver, specifically within the erdma_accept_newconn() function. After the driver calls erdma_cep_put(new_cep), the new_cep connection endpoint structure is freed. A subsequent dereference of the freed pointer creates a UAF condition that can corrupt kernel memory.

The flaw affects multiple Linux kernel stable branches and has been resolved through fixes committed to the mainline kernel tree.

Critical Impact
A local authenticated attacker can trigger the use-after-free to corrupt kernel memory, leading to privilege escalation or kernel-level code execution on systems running the Elastic RDMA (erdma) driver.

Affected Products

Linux Kernel (multiple stable branches prior to patched commits)
Debian LTS distributions shipping affected kernels
Cloud instances with Elastic RDMA (erdma) support enabled

Discovery Timeline

2025-04-16 - CVE-2025-22088 published to the National Vulnerability Database
2025-05 - Debian LTS security announcement issued
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22088

Vulnerability Analysis

The vulnerability resides in the Elastic RDMA (erdma) driver, which supports Alibaba Cloud's high-performance networking hardware. The erdma_accept_newconn() function handles inbound RDMA connection acceptance and manages erdma_cep (connection endpoint) structures via reference counting.

The defect occurs in the connection-accept path. The function invokes erdma_cep_put(new_cep), which decrements the reference count and can free the new_cep object when the count reaches zero. Execution then proceeds to dereference new_cep, accessing memory that may already have been released back to the kernel allocator. This is a classic use-after-free pattern [CWE-416].

Exploitation of the freed slab object can allow an attacker to influence adjacent kernel data structures, potentially achieving arbitrary kernel memory writes and elevated privileges.

Root Cause

The root cause is incorrect object lifetime management. The code path releases the reference to new_cep before completing all operations that depend on the object. Because reference-counted objects in the kernel are freed synchronously when refcount reaches zero, any subsequent access dereferences dangling memory. The upstream fix reorders operations so that new_cep is only released after the final use of the pointer.

Attack Vector

Exploitation requires local access with low-privilege credentials capable of interacting with the RDMA subsystem. The attacker must trigger the erdma connection-accept code path, typically by initiating RDMA connections against a listening endpoint on a host with the erdma driver loaded. No user interaction is required. Successful exploitation yields high impact to confidentiality, integrity, and availability.

The vulnerability is not remotely reachable without a local user context, and there are no public proof-of-concept exploits or evidence of in-the-wild exploitation at this time.

Detection Methods for CVE-2025-22088

Indicators of Compromise

Unexpected kernel oops or KASAN: use-after-free messages referencing erdma_accept_newconn or erdma_cep_put in dmesg.
Unexplained kernel panics on hosts with the erdma module loaded.
Anomalous privilege escalations originating from processes with RDMA capabilities.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface UAF conditions during RDMA workload testing.
Audit loaded kernel modules with lsmod | grep erdma to identify systems in scope.
Correlate kernel crash telemetry with processes that opened RDMA character devices under /dev/infiniband/.

Monitoring Recommendations

Forward kern.log and crash dumps to a centralized logging platform for pattern analysis.
Monitor for unauthorized loading of the erdma module on hosts that do not require RDMA functionality.
Track privilege escalations and new root processes on systems using the erdma driver.

How to Mitigate CVE-2025-22088

Immediate Actions Required

Identify all Linux hosts running kernels with the erdma driver loaded, prioritizing Alibaba Cloud ECS instances and other environments using Elastic RDMA.
Apply distribution kernel updates that include the upstream fix commits.
If patching cannot be performed immediately, unload the erdma module on hosts that do not require RDMA functionality.

Patch Information

The fix has been merged to mainline and backported to multiple stable branches. Reference the following upstream commits:

Debian users should apply the update described in the Debian LTS Security Announcement.

Workarounds

Unload the erdma kernel module on systems that do not require Elastic RDMA connectivity.
Blacklist the module to prevent automatic loading on boot until patched kernels are deployed.
Restrict access to RDMA device nodes under /dev/infiniband/ to trusted service accounts only.

bash

# Unload the erdma driver and prevent it from loading at boot
sudo modprobe -r erdma
echo "blacklist erdma" | sudo tee /etc/modprobe.d/blacklist-erdma.conf
sudo update-initramfs -u