CVE-2025-37772

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Fix workqueue crash in cma_netevent_work_handler

struct rdma_cm_id has member "struct work_struct net_work"

that is reused for enqueuing cma_netevent_work_handler()s

onto cma_wq.

Below crash[1] can occur if more than one call to

cma_netevent_callback() occurs in quick succession,

which further enqueues cma_netevent_work_handler()s for the

same rdma_cm_id, overwriting any previously queued work-item(s)

that was just scheduled to run i.e. there is no guarantee

the queued work item may run between two successive calls

to cma_netevent_callback() and the 2nd INIT_WORK would overwrite

the 1st work item (for the same rdma_cm_id), despite grabbing

id_table_lock during enqueue.

Also drgn analysis [2] indicates the work item was likely overwritten.

Fix this by moving the INIT_WORK() to __rdma_create_id(),

so that it doesn't race with any existing queue_work() or

its worker thread.

[1] Trimmed crash stack:

=======

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References