CVE-2025-22088

What it actually does

Use-after-free in erdma_accept_newconn() where new_cep is dereferenced after erdma_cep_put frees it.

Why it matters to the business

Kernel instability, crashes, or privilege escalation on Linux systems using RDMA/erdma, impacting servers in HPC or storage; high ecosystem prevalence via kernel sources increases exposure risk.

How an attack unfolds

An attacker triggers RDMA connection acceptance to reach the freed pointer dereference after erdma_cep_put; similar kernel privilege escalation patterns from related CVEs indicate potential for code execution or denial of service.

How to fix it

Apply kernel fix from commit bc1db4d8f1b0dc480d7d745a60a8cc94ce2badd4 or upgrade affected Red Hat packages to thunderbird 0:128.5.0-1.el9_0.

How to confirm the fix worked

Confirm kernel source contains the fix commit or package version matches the updated release; review erdma module changelog.

Typical attack path

1. Locate system with erdma RDMA enabled
2. Send crafted connection requests to hit accept path
3. Trigger timing window after cep free
4. Exploit UAF for memory corruption or escalation

How to detect it

Search kernel logs for erdma-related oops/panics around connection acceptance; monitor RDMA traffic for anomalous newconn attempts.

What your security team should do

• Patch kernel immediately on systems exposing RDMA interfaces
• Disable erdma module if not required until updated
• Audit for similar UAF patterns in RDMA drivers