Use After Free Vulnerability in Linux Kernel's RDMA iwcm Component

CVE-2025-38211

What is CVE-2025-38211?

The vulnerability in the Linux kernel's RDMA iwcm component stems from a use-after-free condition where references to 'cm_id_private' objects can persist after the associated 'cm_id' has been destroyed. Following the simplification of 'cm_id' resource management, a flaw was introduced that allows event handler works to reference freed memory locations, leading to potential system instability. This issue can lead to serious security implications, including memory corruption and denial-of-service conditions, notably when subjected to specific test cases like 'nvme/061'. This flaw highlights the importance of rigorous resource management and the necessity of flushing pending works during the destruction of 'cm_id' to mitigate associated risks.

References