CVE-2025-38151 in Linux
Summary
by MITRE • 07/03/2025
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work
The cited commit fixed a crash when cma_netevent_callback was called for a cma_id while work on that id from a previous call had not yet started. The work item was re-initialized in the second call, which corrupted the work item currently in the work queue.
However, it left a problem when queue_work fails (because the item is still pending in the work queue from a previous call). In this case, cma_id_put (which is called in the work handler) is therefore not called. This results in a userspace process hang (zombie process).
Fix this by calling cma_id_put() if queue_work fails.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/18/2026
The vulnerability identified as CVE-2025-38151 resides within the Linux kernel's RDMA (Remote Direct Memory Access) communication management subsystem, specifically affecting the cma_netevent_callback function implementation. This flaw represents a critical race condition and resource management issue that can lead to system instability and process hangs. The vulnerability manifests when the kernel attempts to handle network events for RDMA connections while maintaining proper reference counting and work queue management. The issue stems from improper handling of work item queuing operations that can result in zombie process states and system hangs, directly impacting the reliability of high-performance computing environments that depend on RDMA connectivity.
The technical root cause of this vulnerability lies in the improper management of work queue items within the RDMA connection management framework. When cma_netevent_callback is invoked for a cma_id (connection management identifier) while a previous work item for the same identifier is still pending in the work queue, the system attempts to re-initialize the work item. This re-initialization process corrupts the existing work item that is already scheduled for execution. The fix implemented in the commit addresses the immediate crash scenario but inadvertently introduces a secondary issue where queue_work fails to schedule the work item due to the pending state from a previous call. When queue_work fails, the normal cleanup path through cma_id_put is bypassed, leaving the reference count in an inconsistent state and causing the userspace process to hang indefinitely.
The operational impact of CVE-2025-38151 extends beyond simple system crashes to encompass complete process hang conditions that can severely disrupt high-performance computing clusters, data center operations, and distributed systems relying on RDMA for low-latency communication. This vulnerability affects systems where RDMA is actively used for network communication, particularly in environments such as high-performance computing clusters, storage networks, and cloud infrastructure where RDMA acceleration is common. The hanging behavior creates zombie processes that consume system resources and can lead to cascading failures throughout the system. From an attacker perspective, this vulnerability could be exploited to cause denial of service conditions by triggering the race condition repeatedly, potentially leading to system unresponsiveness and service disruption. The issue aligns with CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and represents a classic race condition scenario that can be leveraged for system stability degradation.
The mitigation strategy for CVE-2025-38151 involves implementing proper error handling in the queue_work failure path by ensuring that cma_id_put is called even when work queuing operations fail. This fix addresses the resource leak condition that occurs when the work item cannot be scheduled due to previous pending operations, preventing the accumulation of unreleased references that lead to process hangs. The solution follows established kernel development practices for error handling and resource management, ensuring that cleanup operations are performed regardless of the success or failure of primary operations. Organizations should prioritize applying this patch to systems running affected kernel versions, particularly those operating RDMA-enabled networks where the vulnerability could be exploited to cause service disruption. The fix demonstrates proper adherence to the principle of defensive programming where resource cleanup is guaranteed even in error conditions, preventing the accumulation of system resources that could lead to broader system instability. This vulnerability highlights the importance of robust error handling in kernel subsystems and the critical need for proper synchronization mechanisms in concurrent environments.