CVE-2025-38211
A use-after-free vulnerability exists in the Linux kernel's RDMA/iwcm component. This flaw occurs when the system attempts to use memory that has already been released during the destruction of communication IDs.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Linux kernel, specifically noted in Debian 11.0, who utilize RDMA/iwcm functionality.
Real-world impact
An attacker could potentially exploit this flaw to cause a system crash or execute arbitrary code by manipulating how the kernel manages memory during RDMA operations.
Why this severity
The critical score reflects that this is a remote, unauthenticated vulnerability that can lead to a complete loss of confidentiality, integrity, and availability.
What to do about it
- 01Apply the fix provided in the Linux kernel commit aee2424246f9 or subsequent updates that address the use-after-free in RDMA/iwcm.
NVD-referenced vendor advisory
Timeline
- Jul 4, 2025 · Jul 4, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/013dcdf6f03bcedbaf…patch
- git.kernel.org/stable/c/23a707bbcbea468eed…patch
- git.kernel.org/stable/c/3b4a50d733acad6831…patch
- git.kernel.org/stable/c/6883b680e703c6b2ef…patch
- git.kernel.org/stable/c/764c9f69beabef8bdc…patch
- git.kernel.org/stable/c/78381dc8a6b61c9bb9…patch
- git.kernel.org/stable/c/bf7eff5e3a36c54bbe…patch
- git.kernel.org/stable/c/fd960b5ddf4faf00da…patch
- lists.debian.org/debian-lts-announce/2025/10…mailing listthird party advisory
- lists.debian.org/debian-lts-announce/2025/10…mailing listthird party advisory