CVE-2025-37772 is a vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) connection management agent (cma) subsystem, specifically related to the handling of workqueue items in the cma_netevent_work_handler function. The issue arises because the struct rdma_cm_id contains a member work_struct net_work that is reused for enqueuing work items onto the cma_wq workqueue. When multiple calls to cma_netevent_callback() occur in rapid succession for the same rdma_cm_id, the INIT_WORK macro is called repeatedly on the same work_struct, overwriting previously queued work items. This leads to a race condition where the queued work item may be overwritten before it is processed, causing the workqueue to dereference a NULL pointer and crash the kernel. The crash stack trace shows a NULL pointer dereference in process_one_work(), triggered by a NULL pool_workqueue pointer (pwq) returned from get_work_pwq() due to corrupted work_struct data. The root cause is that INIT_WORK() is called during cma_netevent_callback(), which races with queue_work() and the worker thread. The fix involves moving the INIT_WORK() call to __rdma_create_id(), ensuring the work_struct is initialized once and preventing concurrent overwrites. This vulnerability can cause kernel crashes (denial of service) on affected Linux systems using RDMA, impacting system stability and availability. No known exploits are reported in the wild as of publication, and no CVSS score is assigned yet.

For European organizations relying on Linux servers with RDMA capabilities—commonly found in high-performance computing, data centers, and enterprise storage environments—this vulnerability poses a risk of kernel crashes leading to denial of service. Such crashes can disrupt critical services, cause downtime, and potentially lead to data loss if systems become unstable. Organizations using RDMA for low-latency networking or storage access, especially in financial services, telecommunications, research institutions, and cloud providers, may experience operational interruptions. While this vulnerability does not directly lead to privilege escalation or data leakage, the resulting instability could be exploited by attackers to cause persistent service outages or to mask other malicious activities. The lack of authentication requirements and the ability to trigger the crash via rapid successive calls to cma_netevent_callback() increase the risk in multi-tenant or exposed environments. However, exploitation requires triggering specific RDMA network events, limiting the attack surface to systems with RDMA enabled and accessible.

European organizations should immediately apply the patch once available that moves the INIT_WORK() call to __rdma_create_id() to prevent the race condition. Until patches are deployed, organizations should consider disabling RDMA functionality if not strictly required, as this will mitigate the risk of triggering the vulnerability. Network segmentation and strict access controls should be enforced to limit exposure of RDMA-enabled systems to untrusted networks or users. Monitoring kernel logs for signs of workqueue crashes or kernel oops events related to rdma_cm can provide early detection of exploitation attempts. Additionally, organizations should review and harden their RDMA configurations, ensuring only trusted hosts can initiate RDMA connections. For critical systems, implementing kernel live patching solutions may reduce downtime during patch deployment. Finally, maintain up-to-date Linux kernel versions and subscribe to vendor security advisories for timely updates.