CVE-2025-38211
NoneCVSS
—
EPSS
0.4%
Published
Jul 4, 2025
CISA due date
—
Cloudanix analysis
A memory handling bug in the Linux kernel's RDMA networking code can cause systems to crash or be taken over when certain network connections are rapidly opened and closed.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Moderate
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Use After Free
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Use-after-free in iw_cm work objects allocated via alloc_work_entries and freed via dealloc_work_entries during cm_id destruction, triggered when the final cm_id reference is dropped inside an event handler work instead of the destruction path, allowing __pwq_activate_work to access a freed slab object on iw_cm_wq.
Why it matters to the business
Kernel crashes or memory corruption on systems using RDMA transports (NVMe-oF, iWARP, siw) can cause service outages, data plane disruption, and potential container escape or privilege escalation in environments with high RDMA usage.
How an attack unfolds
An attacker triggers repeated RDMA connection establishment and teardown sequences (such as blktests nvme/061 over siw) that queue cm_event_handler works; when the last reference drops inside cm_work_handler, dealloc_work_entries frees the work object while it remains queued, leading to slab-use-after-free when the workqueue activates it.
How to fix it
Upgrade the Linux kernel to a version containing commit 013dcdf6f03bcedbaf1669e3db71c34a197715b2; for Chainguard images apply tileserver-gl-fips and tileserver-gl-fips-compat 5.3.1-r3 or newer. Rebuild and reboot affected hosts; test RDMA paths with nvme/061 after patching.
How to confirm the fix worked
Verify kernel build contains 013dcdf6f03bcedbaf1669e3db71c34a197715b2; confirm absence of the KASAN report pattern in dmesg after running RDMA connection stress tests; check that iwcm_deref_id no longer calls dealloc_work_entries from within event handler context.
Typical attack path
- Establish RDMA connection via iw_cm_connect and rdma_connect_locked
- Queue event handler works on iw_cm_wq through cma_work_handler and siw_cm_work_handler
- Force cm_id destruction while works are still pending
- Decrement final reference inside cm_work_handler causing dealloc_work_entries to free the active work object
- Workqueue processes the dangling work entry resulting in KASAN-detected slab-use-after-free
How to detect it
Search kernel logs and dmesg for KASAN slab-use-after-free reports referencing __pwq_activate_work, iw_cm_wq, alloc_work_entries, dealloc_work_entries, or cm_work_handler; inspect crash dumps for kworker/u16 threads and stack traces containing iw_cm or rdma_cm symbols.
- BUG: KASAN: slab-use-after-free in __pwq_activate_work
- Workqueue: iw_cm_wq
- Allocated by task.*alloc_work_entries.*iw_cm
- Freed by task.*dealloc_work_entries.*iw_cm
- iwcm_deref_id
- cm_work_handler
What your security team should do
- Apply the referenced kernel commit or updated package within 30 days given the 480-day publication window and rising EPSS trend
- Prioritize patching on any host exposing RDMA interfaces or running NVMe-oF with siw/iw_cm
- Add SIEM rules for the KASAN signature and iw_cm_wq kworker crashes
- Restrict untrusted RDMA access until patches are deployed
The record
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The references are removed either upon completion of iw_cm event handlers or when the application destroys the cm_id. This commit introduced the use-after-free condition where cm_id_private object could still be in use by event handler works during the destruction of cm_id. The commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs") addressed this use-after- free by flushing all pending works at the cm_id destruction. However, still another use-after-free possibility remained. It happens with the work objects allocated for each cm_id_priv within alloc_work_entries() during cm_id creation, and subsequently freed in dealloc_work_entries() once all references to the cm_id are removed. If the cm_id's last reference is decremented in the event handler work, the work object for the work itself gets removed, and causes the use- after-free BUG below: BUG: KASAN: slab-use-after-free in __pwq_activate_work+0x1ff/0x250 Read of size 8 at addr ffff88811f9cf800 by task kworker/u16:1/147091 CPU: 2 UID: 0 PID: 147091 Comm: kworker/u16:1 Not tainted 6.15.0-rc2+ #27 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 Workqueue: 0x0 (iw_cm_wq) Call Trace: <TASK> dump_stack_lvl+0x6a/0x90 print_report+0x174/0x554 ? __virt_addr_valid+0x208/0x430 ? __pwq_activate_work+0x1ff/0x250 kasan_report+0xae/0x170 ? __pwq_activate_work+0x1ff/0x250 __pwq_activate_work+0x1ff/0x250 pwq_dec_nr_in_flight+0x8c5/0xfb0 process_one_work+0xc11/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5ef/0xfd0 ? __pfx_worker_thread+0x10/0x10 kthread+0x3b0/0x770 ? __pfx_kthread+0x10/0x10 ? rcu_is_watching+0x11/0xb0 ? _raw_spin_unlock_irq+0x24/0x50 ? rcu_is_watching+0x11/0xb0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x30/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 147416: kasan_save_stack+0x2c/0x50 kasan_save_track+0x10/0x30 __kasan_kmalloc+0xa6/0xb0 alloc_work_entries+0xa9/0x260 [iw_cm] iw_cm_connect+0x23/0x4a0 [iw_cm] rdma_connect_locked+0xbfd/0x1920 [rdma_cm] nvme_rdma_cm_handler+0x8e5/0x1b60 [nvme_rdma] cma_cm_event_handler+0xae/0x320 [rdma_cm] cma_work_handler+0x106/0x1b0 [rdma_cm] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 Freed by task 147091: kasan_save_stack+0x2c/0x50 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kfree+0x13a/0x4b0 dealloc_work_entries+0x125/0x1f0 [iw_cm] iwcm_deref_id+0x6f/0xa0 [iw_cm] cm_work_handler+0x136/0x1ba0 [iw_cm] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 Last potentially related work creation: kasan_save_stack+0x2c/0x50 kasan_record_aux_stack+0xa3/0xb0 __queue_work+0x2ff/0x1390 queue_work_on+0x67/0xc0 cm_event_handler+0x46a/0x820 [iw_cm] siw_cm_upcall+0x330/0x650 [siw] siw_cm_work_handler+0x6b9/0x2b20 [siw] process_one_work+0x84f/0x1460 worker_thread+0x5ef/0xfd0 kthread+0x3b0/0x770 ret_from_fork+0x30/0x70 ret_from_fork_asm+0x1a/0x30 This BUG is reproducible by repeating the blktests test case nvme/061 for the rdma transport and the siw driver. To avoid the use-after-free of cm_id_private work objects, ensure that the last reference to the cm_id is decremented not in the event handler works, but in the cm_id destruction context. For that purpose, mo ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | kernel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug-devel-matched | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-debug-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-devel-matched | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-64k-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-abi-stablelists | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-cross-headers | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-devel-matched | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-debug-uki-virt | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-devel-matched | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-doc | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-headers | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-debug | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-debug-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-debug-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-debug-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-debug-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-debug-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-64k-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug-kvm | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-debug-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-kvm | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-rt-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-tools | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-tools-libs | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-tools-libs-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-uki-virt | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-uki-virt-addons | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump-devel | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump-devel-matched | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump-modules | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump-modules-core | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | kernel-zfcpdump-modules-extra | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | libperf | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | perf | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | python3-perf | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | rtla | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:10 | rv | 0 | 6.12.0-55.30.1.el10_0 |
| AlmaLinux:8 | bpftool | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-abi-stablelists | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-core | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-cross-headers | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-debug | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-debug-core | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-debug-devel | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-debug-modules-extra | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-devel | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-doc | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-headers | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-modules | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-modules-extra | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-rt | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-core | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-debug | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-core | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-devel | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-devel | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-modules | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-rt-modules-extra | 0 | 4.18.0-553.72.1.rt7.413.el8_10 |
| AlmaLinux:8 | kernel-tools | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-tools-libs | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-tools-libs-devel | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-core | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | perf | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:8 | python3-perf | 0 | 4.18.0-553.72.1.el8_10 |
| AlmaLinux:9 | kernel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-devel-matched | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-abi-stablelists | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-cross-headers | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-devel-matched | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-debug-uki-virt | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-devel-matched | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-doc | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-headers | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-debug-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-64k-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-kvm | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-kvm | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-rt-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-tools | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-tools-libs | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-tools-libs-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-uki-virt | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-uki-virt-addons | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | libperf | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | perf | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | python3-perf | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | rtla | 0 | 5.14.0-570.39.1.el9_6 |
| AlmaLinux:9 | rv | 0 | 5.14.0-570.39.1.el9_6 |
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.35-1 |
| Debian:14 | linux | 0 | 6.12.35-1 |
| Linux | Kernel | 4.8.0 | 5.4.296 |
| Mageia:9 | kernel | 0 | 6.6.101-1.mga9 |
| Mageia:9 | kernel-linus | 0 | 6.6.101-1.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.1.10-7.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-83.mga9 |
| Mageia:9 | wireless-regdb | 0 | 20250710-1.mga9 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.65.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.269.1 |
Related vulnerabilities
- CVE-2025-68285 In the Linux kernel, the following vulnerability has been resolved: libceph: fix… Also affects kernel
- CVE-2025-68287 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Fix race… Also affects kernel
- CVE-2025-40277 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate… Also affects kernel
- CVE-2025-40240 In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL… Also affects kernel
- CVE-2025-40185 In the Linux kernel, the following vulnerability has been resolved: ice: ice_adapter… Also affects kernel
- CVE-2025-40176 In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending… Also affects kernel
- CVE-2025-40058 In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow… Also affects kernel
- CVE-2025-40047 In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid… Also affects kernel