CVE-2025-38211: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38211 Overview

CVE-2025-38211 is a use-after-free vulnerability in the Linux kernel's RDMA/iwcm (iWARP Connection Manager) subsystem. The flaw resides in the reference counting logic for cm_id objects, where work objects allocated by alloc_work_entries() can be freed while still in use by pending event handler works. When the last reference to a cm_id is decremented inside an event handler work itself, dealloc_work_entries() frees the work object that is currently executing, leading to a use-after-free condition tracked as [CWE-416].

Critical Impact
A local attacker with the ability to trigger RDMA connection events can cause kernel memory corruption, potentially leading to privilege escalation, denial of service, or arbitrary code execution in kernel context.

Affected Products

Linux Kernel (multiple stable branches prior to fix commits)
Debian Linux 11.0
Systems using RDMA/iwcm with drivers such as siw or nvme_rdma

Discovery Timeline

2025-07-04 - CVE-2025-38211 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38211

Vulnerability Analysis

The vulnerability originates in the Linux kernel's RDMA infrastructure, specifically in how the iWARP Connection Manager (iwcm) manages the lifecycle of cm_id_private structures and their associated work objects. Commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") introduced reference-counted freeing of cm_id resources. A follow-up commit aee2424246f9 addressed one use-after-free scenario by flushing pending works during cm_id destruction, but a second race window remained.

Work objects allocated inside alloc_work_entries() during cm_id creation are released by dealloc_work_entries() once all references to the cm_id are dropped. When an event handler work itself holds the final reference, decrementing that reference from within the running work frees the work object it is currently executing. The workqueue infrastructure then dereferences freed memory in __pwq_activate_work() and pwq_dec_nr_in_flight(), producing the KASAN slab-use-after-free reports observed while running the blktests nvme/061 test against the siw driver.

Root Cause

The root cause is incorrect ownership of the final reference release on the cm_id. Because event handler works can hold the last reference, the reference decrement executed inside cm_work_handler() calls iwcm_deref_id(), which invokes dealloc_work_entries() and frees the currently executing work structure. The workqueue then reads freed slab memory when advancing to subsequent work entries.

Attack Vector

Exploitation requires local access to a system with the affected kernel modules loaded and RDMA connectivity available (for example, through siw software iWARP or nvme_rdma). A local user able to open RDMA connections and trigger connection state transitions can race the destruction of a cm_id against pending event handler works. Successful triggering causes kernel slab corruption. Depending on subsequent heap layout, this can be leveraged for privilege escalation or reliable denial of service. The public reproducer uses the blktests nvme/061 case against the siw transport.

No public proof-of-concept exploit is available beyond the reproducer described in the upstream commit message. See the kernel commit history for the technical fix details.

Detection Methods for CVE-2025-38211

Indicators of Compromise

Kernel log entries containing BUG: KASAN: slab-use-after-free in __pwq_activate_work on kernels built with KASAN enabled.
Unexpected kernel panics or oopses referencing iw_cm, cm_work_handler, dealloc_work_entries, or iwcm_deref_id in the call stack.
Repeated crashes correlated with RDMA workload activity involving nvme_rdma, rdma_cm, or the siw driver.

Detection Strategies

Inventory hosts running vulnerable kernel versions with the iw_cm, rdma_cm, siw, or nvme_rdma modules loaded, using lsmod and package version telemetry.
Monitor kernel ring buffer output (dmesg, /var/log/kern.log) for KASAN reports, workqueue faults, and iwcm-related stack traces.
Correlate crash telemetry with process activity to identify local users exercising RDMA APIs on multi-tenant systems.

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on KASAN, Oops, and general protection fault signatures referencing RDMA symbols.
Track loading events for iw_cm, siw, and nvme_rdma modules on hosts where RDMA is not an expected workload.
Baseline RDMA connection rates per host and alert on anomalous bursts that may indicate exploitation attempts.

How to Mitigate CVE-2025-38211

Immediate Actions Required

Apply the vendor-supplied kernel update from your distribution as soon as it is available, particularly the Debian LTS advisories referenced below.
On systems that do not require RDMA, unload and blacklist the iw_cm, siw, and nvme_rdma modules to eliminate the attack surface.
Restrict local user access on multi-tenant systems until patches are deployed, since exploitation requires local privileges.

Patch Information

The upstream fix ensures the final reference to cm_id is decremented in the destruction context rather than inside event handler works, preventing the work object from being freed while still executing. Fixes are distributed across the stable trees in commits 013dcdf, 23a707b, 3b4a50d, 6883b68, 764c9f6, 78381dc, bf7eff5, and fd960b5. Debian users should apply the updates from Debian LTS Announcement msg00007 and Debian LTS Announcement msg00008.

Workarounds

Blacklist the affected modules where RDMA is not required by adding blacklist iw_cm, blacklist siw, and blacklist nvme_rdma entries to /etc/modprobe.d/.
Enforce least-privilege access controls to prevent untrusted local users from invoking RDMA syscalls.
Enable kernel hardening features such as KASLR, SMEP, and SMAP to raise the difficulty of turning the use-after-free into reliable code execution.

bash

# Configuration example: disable vulnerable RDMA modules on hosts that do not need them
cat <<EOF | sudo tee /etc/modprobe.d/disable-rdma-iwcm.conf
blacklist iw_cm
blacklist siw
blacklist nvme_rdma
EOF

sudo update-initramfs -u
sudo reboot