CVE-2025-38024

What it actually does

Use-after-free read in rxe_queue_cleanup due to double-free of memory resources when rxe_cq_from_init fails and subsequent rxe_cleanup is invoked in the RDMA/rxe error path during CQ creation.

Why it matters to the business

Kernel instability, crashes, or memory corruption on Linux systems using RDMA, increasing downtime risk for high-performance networking workloads; published nearly 500 days ago with low but rising exploit probability requires prioritized patching across affected distributions.

How an attack unfolds

An attacker invokes RDMA CQ creation via user-space verbs that forces an error in rxe_cq_from_init after partial allocations, causing the cleanup handler to reference already-freed slab memory and trigger the use-after-free read.

How to fix it

Upgrade to fixed versions: dpkg 1.17.26-1.mga5 on Mageia 5 or Linux kernel commit 7c7c80c32e00665234e373ab03fe82f5c5c2c230; ensure rxe_cleanup exclusively owns all resource release.

How to confirm the fix worked

Confirm presence of the fix by inspecting rxe_cq.c and rxe_queue.c for unified cleanup logic; recompile and run error-injection tests on CQ creation failure paths; verify no KASAN reports on rxe_queue_cleanup.

Typical attack path

1. Issue RDMA create_cq command that reaches rxe_create_cq
2. Force rxe_cq_from_init to fail after allocating queue structures
3. Trigger rxe_cleanup which calls rxe_queue_cleanup on freed memory
4. Read from dangling slab pointer to corrupt kernel state or crash

How to detect it

Search kernel logs and KASAN reports for slab-use-after-free involving rxe_queue_cleanup, rxe_cq_cleanup, or __rxe_cleanup call traces; monitor for unexpected RDMA CQ creation failures followed by panics.

• rxe_queue_cleanup+0xd0/0xe0
• rxe_cq_cleanup+0x3f/0x50
• slab-use-after-free Read in rxe_queue_cleanup
• __rxe_cleanup+0x168/0x300

What your security team should do

• Apply the referenced kernel or package updates immediately on all RDMA-enabled hosts
• Disable RDMA/rxe module if not required until patched
• Add kernel crash and KASAN monitoring for rxe_* functions
• Audit systems for downstream dependents of the affected git tree