CVE-2025-38211

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The references are removed either upon completion of iw_cm event handlers or when the application destroys the cm_id. This commit introduced the use-after-free condition where cm_id_private object could still be in use by event handler works during the destruction of cm_id. The commi...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < 013dcdf6f03bcedbaf1669e3db71c34a197715b2, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < bf7eff5e3a36c54bbe8aff7fd6dd7c07490b81c5, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < 3b4a50d733acad6831f6bd9288a76a80f70650ac, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < 78381dc8a6b61c9bb9987d37b4d671b99767c4a1, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < 23a707bbcbea468eedb398832eeb7e8e0ceafd21, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < 764c9f69beabef8bdc651a7746c59f7a340d104f, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < fd960b5ddf4faf00da43babdd3acda68842e1f6a, >= 59c68ac31e15ad09d2cb04734e3c8c544a95f8d4 < 6883b680e703c6b2efddb4e7a8d891ce1803d06b, >= 4.8, >= 4.8 < 5.4.296, >= 5.5 < 5.10.240, >= 5.11 < 5.15.186, >= 5.16 < 6.1.142, >= 6.2 < 6.6.95, >= 6.7 < 6.12.35, >= 6.13 < 6.15.4, 11.0

Fixed versions

5.4.296, 5.10.240, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416