CVE-2025-38022: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38022 Overview

CVE-2025-38022 is a use-after-free vulnerability [CWE-416] in the Linux kernel's RDMA (Remote Direct Memory Access) core subsystem. The flaw exists in the ib_register_device() function, where kobject_uevent() accesses a device name without lock protection while ib_device_rename() can concurrently rename it. KASAN (Kernel Address Sanitizer) detected a slab-use-after-free read during device registration. The issue mirrors a prior bug fixed by upstream commit 1d6a9e7449e2. Local attackers with low privileges can trigger the race through the RDMA netlink interface (nldev_newlink) to corrupt kernel memory.

Critical Impact
Local exploitation can lead to kernel memory corruption, information disclosure, denial of service, or potential local privilege escalation on affected Linux systems.

Affected Products

Linux Kernel (multiple stable branches prior to the patched commits)
Linux Kernel 6.15-rc1 through 6.15-rc6
Systems with the Soft-RoCE (rxe) RDMA driver enabled

Discovery Timeline

2025-06-18 - CVE-2025-38022 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2025-38022

Vulnerability Analysis

The vulnerability is a use-after-free race condition in the InfiniBand (IB) core code path. During ib_register_device(), the kernel calls kobject_uevent_env() to broadcast a KOBJ_ADD event. That path invokes kobject_get_path(), which calls strlen() on the device's kobject name to compute the path length.

Concurrently, another task can invoke ib_device_rename() to change the device name. ib_device_rename() acquires the appropriate lock, but the read side inside kobject_uevent_env() does not. When the rename frees the old name string while strlen() is still walking it, KASAN reports a slab-use-after-free read in lib/string.c:420.

The stack trace confirms the path: rxe_newlink → rxe_net_add → rxe_register_device → ib_register_device → kobject_uevent_env → kobject_get_path → strlen. Exploitation requires local access and permission to submit RDMA netlink messages.

Root Cause

The root cause is inconsistent locking around the IB device name. ib_device_rename() mutates the name under a lock, but kobject_uevent() reads the same name concurrently without holding that lock. This creates a TOCTOU-style race where the reader can dereference freed memory after the writer swaps the name buffer.

Attack Vector

An authenticated local user with the ability to send RDMA netlink messages (for example, using iproute2 to add a Soft-RoCE link) can race a device registration against a rename operation. Repeatedly triggering nldev_newlink alongside device rename requests can win the race and cause the kernel to read freed slab memory.

No verified public exploit code is available. The vulnerability is documented in the upstream kernel commit messages referenced in the kernel.org stable tree.

Detection Methods for CVE-2025-38022

Indicators of Compromise

KASAN reports containing slab-use-after-free Read in ib_register_device or strlen frames within kobject_get_path.
Unexpected kernel oops, panics, or warnings originating from the drivers/infiniband/core/device.c code path.
Unusual RDMA netlink activity from unprivileged users, especially repeated RDMA_NLDEV_CMD_NEWLINK requests paired with device rename operations.

Detection Strategies

Enable KASAN on test kernels to surface use-after-free reads during RDMA device registration and rename operations.
Audit kernel version and RDMA subsystem configuration across the fleet to identify hosts running unpatched kernels with the rxe or other IB drivers loaded.
Correlate dmesg output and syslog entries for KASAN or general protection fault (GPF) traces referencing ib_register_device or kobject_uevent_env.

Monitoring Recommendations

Monitor auditd for sendmsg syscalls to NETLINK_RDMA sockets originating from non-root or non-service accounts.
Track loaded kernel modules with lsmod and alert when rdma_rxe, ib_core, or related modules load on hosts that do not require RDMA.
Ingest kernel logs into a centralized data lake and build detections for KASAN and slab corruption signatures.

How to Mitigate CVE-2025-38022

Immediate Actions Required

Apply the upstream kernel patches from the stable tree as soon as vendor builds are available for your distribution.
Inventory hosts running affected kernel versions, especially 6.15 release candidates and stable branches predating the fix.
Restrict access to RDMA netlink interfaces so only trusted administrative accounts can create or rename IB devices.

Patch Information

The fix adds lock protection when the device name is accessed in kobject_uevent(). Patched commits are available in the upstream Linux stable tree:

Rebuild and redeploy kernels from your distribution vendor once these commits are backported.

Workarounds

Unload the Soft-RoCE driver where RDMA is not required: modprobe -r rdma_rxe and blacklist the module in /etc/modprobe.d/.
Restrict CAP_NET_ADMIN and access to NETLINK_RDMA sockets so unprivileged users cannot invoke rdma link add operations.
Disable unused RDMA transports and remove iproute2 RDMA tooling from hosts that do not require InfiniBand functionality.