CVE-2025-38287

A flaw was found in the Linux kernel's InfiniBand (IB) Connection Manager (cm) component. A local user could potentially trigger a denial of service (DoS) due to an improper assertion in the cm_free_priv_msg() function. This occurs when the send completion handler attempts to free a message while the cm_id has already advanced to another message, leading to a system warning and potential instability.

This vulnerability is rated as Moderate impact because exploitation requires access to RDMA or InfiniBand subsystems and primarily causes kernel warnings or a local denial of service, without granting arbitrary code execution or data compromise. On typical Red Hat Enterprise Linux systems, InfiniBand hardware and the associated connection management drivers are not loaded unless specialized high-performance networking infrastructure is actively configured. Consequently, environments lacking active RDMA devices are not exposed, limiting the risk to systems with configured InfiniBand fabric.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.