Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw can access RDMA connection data after that data has been freed. On affected systems using the erdma driver, this may cause serious security impact or instability. Exposure is narrower than the 9.8 score alone suggests because the vulnerable subsystem must be relevant to the host.
Executive priority
Treat as urgent for systems actively using erdma, especially network-reachable or high-value infrastructure. Promptly inventory the fleet before assuming broad exposure. Schedule expedited kernel remediation where applicable; track other systems through normal vulnerability management after confirming the driver is not used.
Technical view
CVE-2025-22088 is a use-after-free in erdma_accept_newconn(). The function calls erdma_cep_put(new_cep), which can free new_cep, then subsequently dereferences it. Linux stable commits resolve the unsafe object-lifetime handling. The supplied CVSS 3.1 vector rates network attackability and confidentiality, integrity, and availability impacts as high.
Likely exposure
Potentially exposed systems run an affected Linux kernel and use the RDMA erdma functionality. Systems without relevant erdma hardware, configuration, or workload are less likely to be reachable. The supplied version data is ambiguous, so distribution package status and fix backports must be checked directly.
Exploitation context
The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit. The 9.8 score indicates a severe theoretical attack path, but it does not establish practical exploitability across ordinary Linux installations.
Researcher notes
The root cause is a reference-lifetime error following erdma_cep_put(new_cep). Six Linux stable commit references are supplied. Version entries include unclear values and do not reliably communicate backport status. No source establishes exploitation prerequisites beyond the affected erdma connection path, so further claims would be speculative.
Mitigation direction
- Identify systems using erdma and prioritize externally reachable or business-critical hosts.
- Install a vendor-supported kernel package containing the applicable Linux stable fix.
- Check distribution security guidance because kernel fixes may be backported without changing upstream version numbers.
- Use normal change controls and rollback planning for kernel updates.
Validation and detection
- Record each host's running kernel build and distribution package revision.
- Confirm whether erdma is present and operational on each potentially affected host.
- Verify the vendor package changelog or advisory explicitly includes CVE-2025-22088 or its fix.
- After updating, confirm the fixed kernel is running and RDMA workloads remain healthy.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-22088 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bc1db4d8f1b0dc480d7d745a60a8cc94ce2badd4CVE reference, Linux
- https://git.kernel.org/stable/c/667a628ab67d359166799fad89b3c6909599558aCVE reference, Linux
- https://git.kernel.org/stable/c/a114d25d584c14019d31dbf2163780c47415a187CVE reference, Linux
- https://git.kernel.org/stable/c/78411a133312ce7d8a3239c76a8fd85bca1cc10fCVE reference, Linux
- https://git.kernel.org/stable/c/7aa6bb5276d9fec98deb05615a086eeb893854adCVE reference, Linux
- https://git.kernel.org/stable/c/83437689249e6a17b25e27712fbee292e42e7855CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.