Critical Vulnerability in Linux Kernel: RDMA/core Use-After-Free Issue
Summary
DEBIAN-CVE-2025-38022: In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace: dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/... Affects linux versions < 6.12.30-1. Fixed in 6.12.30-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. The kernel's RDMA (Remote Direct Memory Access) subsystem facilitates high-throughput and low-latency networking, particularly in data centers. However, a recent vulnerability has been identified in this subsystem, which could lead to serious security risks if left unaddressed.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2025-38022, is a use-after-free issue in the RDMA/core component of the Linux kernel. It arises when the function ib_device_rename() renames a device name while another function, kobject_uevent(), accesses this name without proper lock protection. This flaw can potentially allow an attacker to exploit the vulnerability, leading to unauthorized access or system crashes. The vulnerability has been resolved in the patched versions of the Linux kernel, specifically 6.12.30-1 for both Debian 13 and 14.
How To Fix
Minimum fixed version
6.12.30-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The DEBIAN-CVE-2025-38022 vulnerability in the Linux kernel's RDMA/core component poses significant security risks. It is crucial for users to update their systems to the patched version to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
It is a use-after-free vulnerability in the RDMA/core component of the Linux kernel, which can lead to unauthorized access or system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability could allow attackers to gain unauthorized access to system resources or cause system crashes.
Yes, the vulnerability has been patched in version 6.12.30-1 of the Linux kernel for both Debian 13 and 14.
Regularly update your packages and use tools like Vulert to monitor for vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
