Security readout for executives and security teams
Plain-English summary
A Linux RDMA connection-management flaw can free workqueue memory while the kernel is still using it, causing memory corruption or a system crash. The supplied score rates potential impact as critical, but the bundle documents a controlled KASAN crash, not successful compromise in production.
Executive priority
Treat affected, RDMA-enabled infrastructure as an urgent patching priority because this is kernel memory corruption with demonstrated crash potential. Prioritize storage and high-availability systems. Avoid assuming fleet-wide exposure until RDMA usage and branch-specific patch status are verified.
Technical view
A race in RDMA/iwcm permits per-cm_id work entries to be deallocated when an event handler drops the final reference, while workqueue processing still accesses that memory. The resulting slab use-after-free was reproduced with NVMe/RDMA over the SIW driver. Stable-kernel commits change where the final reference is released.
Likely exposure
Exposure is concentrated in affected Linux systems using the iw_cm RDMA path, particularly SIW or NVMe/RDMA configurations. Systems not using these components likely have lower practical exposure. The supplied affected-version data is ambiguous, so kernel status should be verified through branch-specific commits or distribution advisories.
Exploitation context
CISA KEV status is false, and the source bundle provides no evidence of active exploitation or a weaponized public exploit. The reported reproducer triggers a KASAN-detected use-after-free through a kernel regression test. Whether the flaw is practically exploitable beyond denial of service is not established here.
Researcher notes
The flaw follows commit 59c68ac31e15; an earlier correction, aee2424246f9, did not address work objects freed by their own event-handler context. The supplied record references fixes across stable branches. Exact affected and fixed release boundaries cannot be reliably reconstructed from the flattened version list in this bundle.
Mitigation direction
- Apply a vendor kernel security update containing the applicable referenced stable fix.
- Match the running kernel branch to its corresponding upstream fix or distribution advisory.
- Prioritize RDMA storage hosts and systems using iw_cm, SIW, or NVMe/RDMA.
- If patching is delayed, consult vendor guidance about safely disabling unused affected RDMA functionality.
- Test kernel updates against production-equivalent RDMA workloads before broad rollout.
Validation and detection
- Inventory running kernel builds and identify hosts using iw_cm, SIW, or NVMe/RDMA.
- Verify each kernel package includes the applicable stable fix through its changelog or vendor advisory.
- Confirm the updated kernel is active after installation and reboot.
- Review kernel logs for slab-use-after-free reports involving __pwq_activate_work or iw_cm_wq.
- Run approved RDMA regression testing in an isolated environment after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38211 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/013dcdf6f03bcedbaf1669e3db71c34a197715b2CVE reference, Linux
- https://git.kernel.org/stable/c/bf7eff5e3a36c54bbe8aff7fd6dd7c07490b81c5CVE reference, Linux
- https://git.kernel.org/stable/c/3b4a50d733acad6831f6bd9288a76a80f70650acCVE reference, Linux
- https://git.kernel.org/stable/c/78381dc8a6b61c9bb9987d37b4d671b99767c4a1CVE reference, Linux
- https://git.kernel.org/stable/c/23a707bbcbea468eedb398832eeb7e8e0ceafd21CVE reference, Linux
- https://git.kernel.org/stable/c/764c9f69beabef8bdc651a7746c59f7a340d104fCVE reference, Linux
- https://git.kernel.org/stable/c/fd960b5ddf4faf00da43babdd3acda68842e1f6aCVE reference, Linux
- https://git.kernel.org/stable/c/6883b680e703c6b2efddb4e7a8d891ce1803d06bCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.