CVE-2025-38151

What it actually does

Race condition in RDMA/cma where cma_netevent_callback failing to queue_work skips the cma_id_put reference count decrement, leaving a pending work item and causing userspace process hang.

Why it matters to the business

Userspace processes using RDMA can become unresponsive zombie processes, leading to resource exhaustion and operational disruption on Linux systems handling high-speed networking.

How an attack unfolds

An attacker repeatedly triggers netdevice events on an RDMA device to invoke cma_netevent_callback multiple times before prior work items complete; when queue_work fails due to a still-pending item, the missing cma_id_put leaves the process hung.

How to fix it

Upgrade the Linux kernel to version 6.1.142 or later, or apply commit 1ac40736c8c4255d8417b937c9715b193f4a87b3; update clamav to 0.103.7-1.mga8 on Mageia 8 systems.

How to confirm the fix worked

Verify running kernel version is at or above the fixed release; exercise RDMA connection establishment under netdevice event load and confirm no zombie processes remain.

Typical attack path

1. Trigger rapid netdevice events against an RDMA-capable interface
2. Cause overlapping calls to cma_netevent_callback before work handler runs
3. Force queue_work to return failure because the work item is still queued
4. Observe unbalanced reference count and resulting userspace process hang

How to detect it

Search process listings and kernel logs for RDMA-related work queue failures or cma_id references that never complete; inspect for zombie processes tied to RDMA applications after network events.

What your security team should do

• Apply kernel updates to 6.1.142 or equivalent stable branches immediately on all RDMA-enabled hosts
• Audit systems for long-running RDMA processes that may be hung and restart them after patching
• Monitor EPSS trend and kernel privilege-escalation activity from related CVEs for combined risk