CVE-2025-38287: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered related to the IB/cm (InfiniBand Connection Manager) component. The issue involves dropping lockdep assert and WARN conditions when freeing old messages. The vulnerability was assigned CVE-2025-38287 and was disclosed on July 10, 2025 (NVD).

The vulnerability occurs when the send completion handler runs after cmid has advanced to another message. While the cmid lock is not needed in this case, a recent change re-used cmfreeprivmsg(), which incorrectly asserts that the lock is held and triggers a WARN if the cmid's currently outstanding message differs from the one being freed (NVD).

The impact of this vulnerability appears to be limited to system stability and potential denial of service conditions when handling InfiniBand connection management messages. The issue could lead to system warnings and potential crashes when specific message handling conditions are met (NVD).

The vulnerability has been resolved in the Linux kernel through patches that modify the message handling behavior. Two specific commits have been implemented to address this issue (Kernel Commit 1, Kernel Commit 2).