In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix slab-use-after-free Read in rxequeuecleanup bug
Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x7d/0xa0 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xcf/0x610 mm/kasan/report.c:489 kasanreport+0xb5/0xe0 mm/kasan/report.c:602 rxequeuecleanup+0xd0/0xe0 drivers/infiniband/sw/rxe/rxequeue.c:195 rxecqcleanup+0x3f/0x50 drivers/infiniband/sw/rxe/rxecq.c:132 _rxecleanup+0x168/0x300 drivers/infiniband/sw/rxe/rxepool.c:232 rxecreatecq+0x22e/0x3a0 drivers/infiniband/sw/rxe/rxeverbs.c:1109 createcq+0x658/0xb90 drivers/infiniband/core/uverbscmd.c:1052 ibuverbscreatecq+0xc7/0x120 drivers/infiniband/core/uverbscmd.c:1095 ibuverbswrite+0x969/0xc90 drivers/infiniband/core/uverbsmain.c:679 vfswrite fs/readwrite.c:677 [inline] vfswrite+0x26a/0xcc0 fs/readwrite.c:659 ksyswrite+0x1b8/0x200 fs/readwrite.c:731 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xaa/0x1b0 arch/x86/entry/common.c:83 entrySYSCALL64after_hwframe+0x77/0x7f
In the function rxecreatecq, when rxecqfrominit fails, the function rxecleanup will be called to handle the allocated resources. In fact, some memory resources have already been freed in the function rxecqfrom_init. Thus, this problem will occur.
The solution is to let rxe_cleanup do all the work.
[
{
"id": "CVE-2025-38024-1a92388a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"44965528975304386575412078317024930856",
"196421290859758048323997218584565494594",
"235425473174389672076705342939834229757"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52daccfc3fa68ee1902d52124921453d7a335591"
},
{
"id": "CVE-2025-38024-3cd1ad3a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"109446497691686217912161105320625582728",
"276783854558181670932037358944119940043",
"213940687888098828347846407512538358730"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8f470e3a757425a8f98fb9a5991e3cf62fc7134"
},
{
"id": "CVE-2025-38024-3e503e59",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "10625779156077535207898538727476572087",
"length": 674.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336edd6b0f5b7fbffc3e065285610624f59e88df"
},
{
"id": "CVE-2025-38024-54daa528",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "10625779156077535207898538727476572087",
"length": 674.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81b33582f9339d2dc17c69b92040d3650bb4bae"
},
{
"id": "CVE-2025-38024-6c529f64",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"44965528975304386575412078317024930856",
"214839818570770367540538880916892265985",
"289389905331176463550976368337682468552"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f81b33582f9339d2dc17c69b92040d3650bb4bae"
},
{
"id": "CVE-2025-38024-7487df95",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"44965528975304386575412078317024930856",
"214839818570770367540538880916892265985",
"289389905331176463550976368337682468552"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4c5a2a38596d548566560c0c022ab797e6f71a"
},
{
"id": "CVE-2025-38024-7a7a0c6e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"109446497691686217912161105320625582728",
"276783854558181670932037358944119940043",
"213940687888098828347846407512538358730"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c7c80c32e00665234e373ab03fe82f5c5c2c230"
},
{
"id": "CVE-2025-38024-83a6bc90",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "233789106210853141673116660514533527802",
"length": 739.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c7c80c32e00665234e373ab03fe82f5c5c2c230"
},
{
"id": "CVE-2025-38024-bcc313c2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "10625779156077535207898538727476572087",
"length": 674.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16c45ced0b3839d3eee72a86bb172bef6cf58980"
},
{
"id": "CVE-2025-38024-cafd4ae2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "10625779156077535207898538727476572087",
"length": 674.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4c5a2a38596d548566560c0c022ab797e6f71a"
},
{
"id": "CVE-2025-38024-ccacb3b1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "167870222773614438385868661554824205540",
"length": 750.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@52daccfc3fa68ee1902d52124921453d7a335591"
},
{
"id": "CVE-2025-38024-dc8f86f5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"109446497691686217912161105320625582728",
"276783854558181670932037358944119940043",
"213940687888098828347846407512538358730"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a3b73e135e3bd18423d0baa72571319c7feb759"
},
{
"id": "CVE-2025-38024-e463bb8c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "288053983470000144264437835699533566272",
"length": 712.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a3b73e135e3bd18423d0baa72571319c7feb759"
},
{
"id": "CVE-2025-38024-e5825d41",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"44965528975304386575412078317024930856",
"214839818570770367540538880916892265985",
"289389905331176463550976368337682468552"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@336edd6b0f5b7fbffc3e065285610624f59e88df"
},
{
"id": "CVE-2025-38024-e5e4ce1f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "181307976374077343821068087912598813161",
"length": 759.0
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c",
"function": "rxe_cq_from_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8f470e3a757425a8f98fb9a5991e3cf62fc7134"
},
{
"id": "CVE-2025-38024-f7770a2b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"49596285047238503793107675185066994809",
"45169721390153717649951038799891822783",
"40821082502068484547173173818764842172",
"276325890260991560116719944126015534838",
"85747107892502787873459128002444583906",
"44965528975304386575412078317024930856",
"214839818570770367540538880916892265985",
"289389905331176463550976368337682468552"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/sw/rxe/rxe_cq.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@16c45ced0b3839d3eee72a86bb172bef6cf58980"
}
]