Security readout for executives and security teams
Plain-English summary
A timing flaw in the Linux kernel's RDMA subsystem can access a device name after its memory is freed. A local, low-privileged user may be able to trigger the condition without user interaction. The supplied CVSS assessment indicates possible system compromise or disruption, but the sources do not establish a practical exploit.
Executive priority
Treat as a high-priority kernel maintenance issue on RDMA-enabled systems accessible to untrusted local users. Patch through normal emergency or accelerated maintenance according to exposure. Systems without relevant RDMA functionality or untrusted local access are lower priority, but package status should still be verified.
Technical view
A race exists because ib_device_rename() changes the RDMA device name under locking while kobject_uevent() could access it without equivalent protection. The resulting use-after-free appears during RDMA device registration, including the software RXE path. The kernel fix adds locking around the name access in kobject_uevent().
Likely exposure
Exposure is limited to affected Linux kernels where relevant RDMA functionality is present and reachable locally. The supplied version data spans multiple kernel branches but is not sufficiently clear for reliable package-level decisions. Distribution backports may also change exposure, so assess the running vendor kernel rather than version numbers alone.
Exploitation context
CVSS 3.1 scores this 7.8: local access, low complexity, low privileges, no interaction, and potentially high confidentiality, integrity, and availability impact. The supplied bundle marks KEV false, and no cited source reports active exploitation. Public exploit availability and reliable real-world impact are not established by these sources.
Researcher notes
The evidence demonstrates a locking defect and KASAN-detected slab use-after-free, not a documented exploitation primitive. Important open questions include reachability under namespace and capability controls, allocator reliability, and whether vendor configurations expose the RXE netlink path. Avoid inferring remote reachability from RDMA usage alone.
Mitigation direction
- Install a vendor-supported kernel containing the applicable cited stable fix.
- Consult the Linux distribution's advisory for exact package and backport status.
- Prioritize RDMA-enabled multi-user, compute, virtualization, and high-availability systems.
- If patching is delayed, restrict untrusted local access and unnecessary RDMA availability.
Validation and detection
- Inventory running kernel builds and map them to distribution security advisories.
- Determine whether RDMA core and software RXE functionality are enabled or used.
- Confirm the installed kernel includes the applicable stable fix or vendor backport.
- Review kernel logs for use-after-free, KASAN, RDMA registration, or unexplained crash indicators.
- After updating, verify every affected host booted into the remediated kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38022 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ba467b6870ea2a73590478d9612d6ea1dcdd68b7CVE reference, Linux
- https://git.kernel.org/stable/c/5629064f92f0de6d6b3572055cd35361c3ad953cCVE reference, Linux
- https://git.kernel.org/stable/c/312dae3499106ec8cb7442ada12be080aa9fbc3bCVE reference, Linux
- https://git.kernel.org/stable/c/17d3103325e891e10994e7aa28d12bea04dc2c60CVE reference, Linux
- https://git.kernel.org/stable/c/10c7f1c647da3b77ef8827d974a97b6530b64df0CVE reference, Linux
- https://git.kernel.org/stable/c/03df57ad4b0ff9c5a93ff981aba0b42578ad1571CVE reference, Linux
- https://git.kernel.org/stable/c/d0706bfd3ee40923c001c6827b786a309e2a8713CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.