Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its own

CVSS 7.8CVE-2025-40061Firmware, BMC & network fabriccurated

Impact

Use-after-free from a race between a busy soft-RoCE task and its own teardown. A task that exhausts its work budget resets its state and reschedules itself, silently overwriting the draining state set by cleanup - so cleanup proceeds and frees objects the rescheduled task keeps using. Heap corruption reachable by an unprivileged tenant.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on a node with rdma_rxe loaded: keep a queue-pair saturated with work (which forces the task to hit its iteration limit) while destroying or disabling it. Inbound traffic from a peer on the fabric makes the busy state easy to sustain. rxe only.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: blacklist/unload rdma_rxe where soft-RoCE is not required, and drop /dev/infiniband/* from containers that do not use verbs.

References

https://git.kernel.org/stable/c/85288bcf7ffe11e7b036edf91937bc62fd384076 https://git.kernel.org/stable/c/52edccfb555142678c836c285bf5b4ec760bd043 https://nvd.nist.gov/vuln/detail/CVE-2025-40061

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.