CVE-2025-38022

What it actually does

Use-after-free read in ib_register_device due to concurrent access to device name without lock protection between ib_device_rename() and kobject_uevent() during RDMA device registration.

Why it matters to the business

Kernel instability or crashes on Linux systems using RDMA/Infiniband hardware or software emulation, with potential for information disclosure; widespread impact given Linux kernel prevalence and listed downstream dependents.

How an attack unfolds

Attacker triggers concurrent device rename and registration via netlink or RDMA interfaces to race ib_device_rename() and kobject_uevent(), causing slab-use-after-free read; similar to prior device rename UAF fixed in commit 1d6a9e7449e2, and observed in context of Advanced Spyware Campaign and multiple Linux kernel privilege escalation CVEs including CVE-2025-38350, CVE-2025-38477, CVE-2025-37890, and CVE-2025-38083.

How to fix it

Upgrade Linux kernel to fixed version 5.10.248 or apply commit ba467b6870ea2a73590478d9612d6ea1dcdd68b7; update bind on Mageia 5 to 9.10.3.P2-1.mga5; apply equivalent patches across all affected stable trees.

How to confirm the fix worked

Verify kernel version is at or above 5.10.248 or contains commit ba467b6870ea2a73590478d9612d6ea1dcdd68b7; reproduce registration/rename under KASAN to confirm absence of use-after-free.

Typical attack path

1. Send netlink message to trigger rxe_newlink or nldev_newlink
2. Initiate concurrent ib_device_rename via RDMA core
3. Trigger kobject_uevent_env during ib_register_device without lock
4. Access freed device name string causing KASAN slab-use-after-free read

How to detect it

Search kernel logs and KASAN reports for stack traces containing ib_register_device, kobject_uevent_env, kobject_get_path, and strlen during RDMA device registration; correlate with netlink sendmsg activity and device rename operations.

• ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393
• kobject_uevent_env+0x289/0x1870
• KASAN: slab-use-after-free Read in ib_register_device
• strlen+0x93/0xa0 lib/string.c:420
• rxe_register_device+0x275/0x320

What your security team should do

• Immediately patch all Linux systems with RDMA enabled to the listed fixed versions given 496 days since publication
• Monitor for related kernel privilege escalation activity tied to listed threat actors and CVEs
• Disable unnecessary RDMA/rxe modules where possible until patched
• Prioritize systems with high EPSS-adjacent exposure despite low score