Kernel Crash Vulnerability in Linux Package due to Double-Destroyed Definers
Summary
CVE-2025-21675: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select structure on error so no stale values left after definers are destroyed. Affects linux versions < 6.1.128-1. Fixed in 6.1.128-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system, including process management, memory management, and device control. This vulnerability specifically affects the Linux kernel versions in Debian 12 and 13, where a flaw in the mlx5 networking driver can lead to system instability and crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mlx5 networking driver related to the handling of port select structures. When the creation of lag definers fails, the existing port select structure is not cleared, leading to stale values persisting after the definers are destroyed. This results in a scenario where the same definer can be destroyed multiple times, causing a kernel NULL pointer dereference and ultimately leading to a system crash. The vulnerability can be exploited under specific conditions, particularly when creating lag definers, and can result in significant system downtime and instability.
How To Fix
Minimum fixed version
6.1.128-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as they are released.
Conclusion
The CVE-2025-21675 vulnerability poses a significant risk to systems running affected versions of the Linux kernel in Debian 12 and 13. It is essential for users to stay informed about this issue and apply the necessary updates to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21675 is a vulnerability in the Linux kernel's mlx5 networking driver that can cause a kernel crash due to improper handling of port select structures.
This vulnerability can lead to system crashes and instability, particularly when creating lag definers in the networking stack.
If you are using the Linux kernel versions in Debian 12 or 13, it is advisable to check for updates and apply them to mitigate this vulnerability.
While there are no specific workarounds, it is crucial to monitor your system for any signs of instability and plan to apply the updates as soon as possible.
You can find more details about CVE-2025-21675 on the official CVE database or by visiting security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
