CVE-2025-38211 RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses Two RDMA/iwcm Vulnerabilities in February 2026 Microsoft has published information on two vulnerabilities affecting the RDMA/iwcm component. CVE-2025-38211, published on July 4, 2025, addresses a use-after-free issue after cm_id destruction, while CVE-2024-47696, published on October 21, 2024, resolves a warning related to workqueue dependencies. Both vulnerabilities could impact systems utilizing RDMA technology. 2 sources 39