Skip to main content

Linux Kernel CVE-2025-39979

HIGH
2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local trigger via RDMA verbs (AV:L) needs low-privilege device access (PR:L), no user interaction, and a kernel UAF yields full memory-corruption impact (C:H/I:H/A:H) with AC:L given no hard race.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.6 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 08:08 vuln.today
CVE Published
Oct 15, 2025 - 08:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: fs, fix UAF in flow counter release

Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not initialized and the counter struct could already be freed when deleting the rule.

Fix it by adding the missing initializations and adding refcount for the local flow counter struct.

[1] Kernel log: Call Trace: <TASK> dump_stack_lvl+0x34/0x48 mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core] mlx5_fc_put_hws_action+0x96/0xad [mlx5_core] mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core] mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core] del_hw_fte+0x1ce/0x260 [mlx5_core] mlx5_del_flow_rules+0x12d/0x240 [mlx5_core] ? ttwu_queue_wakelist+0xf4/0x110 mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib] uverbs_free_flow+0x20/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs] uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs] uobj_destroy+0x3c/0x80 [ib_uverbs] ib_uverbs_run_method+0x23e/0x360 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs] ? do_tty_write+0x1a9/0x270 ? file_tty_write.constprop.0+0x98/0xc0 ? new_sync_write+0xfc/0x190 ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs] __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x59/0x90

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's Mellanox/NVIDIA mlx5 networking driver arises from a use-after-free in the hardware-steering (HWS) flow-counter release path. When a flow rule tied to a local flow counter is deleted via the RDMA/InfiniBand verbs interface, mlx5_cmd_hws_delete_fte() releases an HWS action whose refcount and mutex were never initialized, and the counter struct may already be freed - allowing a local attacker with the ability to create and destroy flow rules to corrupt kernel memory. No public exploit has been identified at time of analysis; EPSS probability is low (0.17%, 7th percentile), and the issue is not in CISA KEV.

Technical ContextAI

The flaw lives in the mlx5_core driver that operates NVIDIA/Mellanox ConnectX-series NICs, specifically in the newer Hardware Steering (HWS) flow-management path used to program flow tables (FTEs) on the device. The root cause is a use-after-free (CWE-416): a local flow counter's HWS action structure is torn down in mlx5_fc_put_hws_action()/mlx5_fs_put_hws_action() during mlx5_fs_destroy_fs_actions(), but the action's refcount and protecting mutex were left uninitialized and the underlying counter struct could be freed before the delete completes. The trigger path runs through the ib_uverbs layer (mlx5_ib_destroy_flow → uverbs_free_flow), meaning the vulnerable code is reachable from userspace RDMA verbs ioctls. The upstream fix adds the missing refcount/mutex initialization and introduces a reference count on the local flow-counter struct so it is not freed while still in use.

Affected ProductsAI

The affected product is the Linux kernel, specifically the mlx5_core driver (net/mlx5 flow-steering subsystem) used by NVIDIA/Mellanox ConnectX NICs, in kernel versions that include the Hardware Steering (HWS) flow-counter code prior to this fix. Exact affected version ranges are not enumerated in the provided data; they must be derived from the stable-tree commits at https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5 and https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975, which identify the fixed stable branches. No CPE strings were supplied in the input, so precise version boundaries should be confirmed against your distribution's kernel changelog.

RemediationAI

Update to a kernel build that includes the upstream mlx5 fix; the corrective change is available as stable-tree commits (https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5 and https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975), so apply the vendor/distribution kernel that backports these commits - a specific released patched version is not independently confirmed from the provided data, so consult your distro's advisory for the exact package version. Because exploitation requires driving the mlx5 RDMA/verbs flow-rule interface, an effective compensating control where patching is delayed is to restrict access to RDMA/InfiniBand devices - remove or tighten permissions on /dev/infiniband/* and limit CAP_NET_RAW so untrusted local users cannot create/destroy flow rules (trade-off: this breaks legitimate RDMA and user-space verbs workloads such as RoCE/NVMe-oF applications). On systems that do not need RDMA, unloading or blacklisting the mlx5_ib module eliminates the reachable path entirely (trade-off: disables InfiniBand/RoCE functionality on ConnectX adapters).

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected

Share

CVE-2025-39979 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy