In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix "KASAN: slab-use-after-free Read in ibregisterdevice" problem
Call Trace:
dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x116/0x1f0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:408 [inline] printreport+0xc3/0x670 mm/kasan/report.c:521 kasanreport+0xe0/0x110 mm/kasan/report.c:634 strlen+0x93/0xa0 lib/string.c:420 _fortifystrlen include/linux/fortify-string.h:268 [inline] getkobjpathlength lib/kobject.c:118 [inline] kobjectgetpath+0x3f/0x2a0 lib/kobject.c:158 kobjectueventenv+0x289/0x1870 lib/kobjectuevent.c:545 ibregisterdevice drivers/infiniband/core/device.c:1472 [inline] ibregisterdevice+0x8cf/0xe00 drivers/infiniband/core/device.c:1393 rxeregisterdevice+0x275/0x320 drivers/infiniband/sw/rxe/rxeverbs.c:1552 rxenetadd+0x8e/0xe0 drivers/infiniband/sw/rxe/rxenet.c:550 rxenewlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 nldevnewlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796 rdmanlrcvmsg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195 rdmanlrcvskb.constprop.0.isra.0+0x2e5/0x450 netlinkunicastkernel net/netlink/afnetlink.c:1313 [inline] netlinkunicast+0x53a/0x7f0 net/netlink/afnetlink.c:1339 netlinksendmsg+0x8d1/0xdd0 net/netlink/afnetlink.c:1883 socksendmsgnosec net/socket.c:712 [inline] _socksendmsg net/socket.c:727 [inline] syssendmsg+0xa95/0xc70 net/socket.c:2566 _syssendmsg+0x134/0x1d0 net/socket.c:2620 _syssendmsg+0x16d/0x220 net/socket.c:2652 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xcd/0x260 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f
This problem is similar to the problem that the commit 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name") fixes.
The root cause is: the function ibdevicerename() renames the name with lock. But in the function kobject_uevent(), this name is accessed without lock protection at the same time.
The solution is to add the lock protection when this name is accessed in the function kobject_uevent().
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"166325947309390477288570287383172804827",
"143073629008821946474419980826268602652",
"336869829243503211868676506954592870763",
"80322121822206641072739891135892018843",
"53847244591199713222327039983146693632",
"51948563377638322576097112063212046594",
"152691560647268550865770411503594333788",
"337934550119212550299374014717566608114"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03df57ad4b0ff9c5a93ff981aba0b42578ad1571",
"id": "CVE-2025-38022-1f92f328"
},
{
"digest": {
"length": 421.0,
"function_hash": "7572832480501117981220194146585464476"
},
"signature_type": "Function",
"target": {
"function": "ib_device_notify_register",
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10c7f1c647da3b77ef8827d974a97b6530b64df0",
"id": "CVE-2025-38022-67f651a0"
},
{
"digest": {
"length": 1459.0,
"function_hash": "122294888605700380467560259681148540647"
},
"signature_type": "Function",
"target": {
"function": "ib_register_device",
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0706bfd3ee40923c001c6827b786a309e2a8713",
"id": "CVE-2025-38022-9557d190"
},
{
"digest": {
"length": 1459.0,
"function_hash": "122294888605700380467560259681148540647"
},
"signature_type": "Function",
"target": {
"function": "ib_register_device",
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03df57ad4b0ff9c5a93ff981aba0b42578ad1571",
"id": "CVE-2025-38022-95736900"
},
{
"digest": {
"length": 421.0,
"function_hash": "7572832480501117981220194146585464476"
},
"signature_type": "Function",
"target": {
"function": "ib_device_notify_register",
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@03df57ad4b0ff9c5a93ff981aba0b42578ad1571",
"id": "CVE-2025-38022-9dd73c1b"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"166325947309390477288570287383172804827",
"143073629008821946474419980826268602652",
"336869829243503211868676506954592870763",
"80322121822206641072739891135892018843",
"53847244591199713222327039983146693632",
"51948563377638322576097112063212046594",
"152691560647268550865770411503594333788",
"337934550119212550299374014717566608114"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10c7f1c647da3b77ef8827d974a97b6530b64df0",
"id": "CVE-2025-38022-a97e0dd4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"166325947309390477288570287383172804827",
"143073629008821946474419980826268602652",
"336869829243503211868676506954592870763",
"80322121822206641072739891135892018843",
"53847244591199713222327039983146693632",
"51948563377638322576097112063212046594",
"152691560647268550865770411503594333788",
"337934550119212550299374014717566608114"
]
},
"signature_type": "Line",
"target": {
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0706bfd3ee40923c001c6827b786a309e2a8713",
"id": "CVE-2025-38022-ab70e08f"
},
{
"digest": {
"length": 421.0,
"function_hash": "7572832480501117981220194146585464476"
},
"signature_type": "Function",
"target": {
"function": "ib_device_notify_register",
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0706bfd3ee40923c001c6827b786a309e2a8713",
"id": "CVE-2025-38022-ec97b7a8"
},
{
"digest": {
"length": 1459.0,
"function_hash": "122294888605700380467560259681148540647"
},
"signature_type": "Function",
"target": {
"function": "ib_register_device",
"file": "drivers/infiniband/core/device.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10c7f1c647da3b77ef8827d974a97b6530b64df0",
"id": "CVE-2025-38022-f426115c"
}
]