CVE-2025-38582

What it actually does

Double destruction of a reserved QP in the hns_roce driver triggers list_del corruption during error paths in free_mr_init and hns_roce_exit, resulting in a use-after-free condition.

Why it matters to the business

Systems using affected Linux kernels with RoCE hardware may experience kernel crashes or instability during driver initialization or reset operations, increasing downtime risk and operational overhead; prevalence in container-optimized environments heightens exposure for cloud workloads.

How an attack unfolds

An attacker triggers error paths during RoCE QP teardown (via device reset or initialization failure) to cause the double free; this can be reached through local privilege escalation attempts in containerized setups where kernel modules are exercised, potentially leading to memory corruption that threat actors have targeted in similar Linux kernel flaws on Container-Optimized OS.

How to fix it

Update the Linux kernel to commit dab173bae3303f074f063750a8dead2550d8c782 or later; for Chainguard packages apply openjdk-17-openj9 updates to 0.53.0-r0 where applicable. Rebuild and reboot affected systems after patching.

How to confirm the fix worked

Verify kernel source contains dab173bae3303f074f063750a8dead2550d8c782; confirm absence of double free_mr_init calls outside hns_roce_v2_init; test device reset flows on hns_roce hardware.

Typical attack path

1. Trigger RDMA/hns device reset or initialization error condition
2. Force execution of free_mr_init followed by hns_roce_exit paths
3. Induce list_del on already-freed QP structure
4. Exploit resulting use-after-free for memory corruption or denial of service

How to detect it

Review kernel logs for list_del corruption warnings mentioning hns_roce_qp_remove or free_mr_exit during reset or initialization; correlate with hclge reset service tasks and container privilege escalation attempts noted in related kernel issues.

What your security team should do

• Prioritize kernel upgrades on systems with hns_roce hardware within 30 days given rising EPSS trend
• Monitor container-optimized OS instances for similar privilege escalation patterns
• Disable unused RDMA interfaces where possible until patched