CVE-2025-38024

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. This use-after-free vulnerability occurs in the rxe_create_cq function. When the rxe_cq_from_init function fails, the subsequent call to rxe_cleanup attempts to free memory resources that have already been released, leading to memory corruption. A local attacker with high privileges could exploit this flaw to cause a denial of service or potentially achieve arbitrary code execution.

Moderate: A use-after-free leading to a kernel information leak issue was seen in the Linux kernel's RDMA rxe component, which allows a local attacker with special group privilege to cause a denial of service. This flaw affects Red Hat Enterprise Linux 7, 8, and 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the rxe kernel module from loading. This can be achieved by creating a blacklist rule.

1. Create a file /etc/modprobe.d/blacklist-rxe.conf with the following content:

blacklist rxe
install rxe /bin/true

2. Rebuild the initial ramdisk:

dracut -f -v

3. Reboot the system for the changes to take effect.

Warning: Blacklisting the rxe module may impact functionality that relies on Soft RoCE.