CVE-2025-38024

Q: What is the severity of CVE-2025-38024?

CVE-2025-38024 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's RDMA over Converged Ethernet (RoCE) implementation allows reading freed memory when creating completion queues fails. This affects systems using the rxe driver for RDMA networking, potentially exposing kernel memory contents to local attackers.

7.8 HIGH

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's RDMA over Converged Ethernet (RoCE) implementation allows reading freed memory when creating completion queues fails. This affects systems using the rxe driver for RDMA networking, potentially exposing kernel memory contents to local attackers.

💻 Affected Systems

Products:

Linux kernel with rxe RDMA driver enabled

Versions: Kernel versions before fixes in stable releases (specific commits listed in references)

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if RDMA/rxe driver is loaded and users have permissions to create completion queues.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to information leaks, potential privilege escalation if combined with other vulnerabilities, or system instability/crash.

🟠

Likely Case

Information disclosure of kernel memory contents to local users, potentially revealing sensitive data or memory addresses useful for further exploitation.

🟢

If Mitigated

Limited impact with proper access controls preventing local users from creating RDMA completion queues.

🌐 Internet-Facing: LOW - Requires local access to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Local users or processes with RDMA permissions can trigger the bug.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger RDMA completion queue creation failure scenarios.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits: 16c45ced0b3839d3eee72a86bb172bef6cf58980, 336edd6b0f5b7fbffc3e065285610624f59e88df, 3a3b73e135e3bd18423d0baa72571319c7feb759, 52daccfc3fa68ee1902d52124921453d7a335591, 7c7c80c32e00665234e373ab03fe82f5c5c2c230

Vendor Advisory: https://git.kernel.org/stable/c/16c45ced0b3839d3eee72a86bb172bef6cf58980

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Reboot system to load patched kernel. 3. Verify rxe driver is using patched code.

🔧 Temporary Workarounds

Disable rxe RDMA driver

linux

Prevent loading of vulnerable rxe driver module

echo 'blacklist rxe' >> /etc/modprobe.d/blacklist-rxe.conf
rmmod rxe

Restrict RDMA permissions

linux

Limit users who can create RDMA completion queues

chmod 600 /dev/infiniband/*
setfacl -m u:root:rw- /dev/infiniband/*

🧯 If You Can't Patch

Restrict local user access to systems with RDMA capabilities
Implement strict monitoring for RDMA-related system calls and log analysis

🔍 How to Verify

Check if Vulnerable:

Check if rxe module is loaded: lsmod | grep rxe AND check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and test RDMA completion queue creation failure scenarios

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
KASAN reports of use-after-free in rxe_queue_cleanup
Failed RDMA completion queue creation attempts

Network Indicators:

Unusual RDMA traffic patterns
Multiple failed RDMA connection attempts

SIEM Query:

source="kernel" AND ("rxe_queue_cleanup" OR "use-after-free" OR "KASAN")

📊 Metadata

CVE ID: CVE-2025-38024

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

EPSS Score: 0.02% exploit probability (5.3th percentile)

Published: June 18, 2025

Last Updated: December 17, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable rxe RDMA driver

Restrict RDMA permissions

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities