Critical Crash Vulnerability in Linux Kernel's mlx5 Bridge Handling
Summary
CVE-2025-21970: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Bridge, fix the crash caused by LAG state check When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The mlx5 driver is responsible for managing Mellanox Ethernet devices, enabling high-performance networking capabilities. This vulnerability affects the bridge functionality within the mlx5 driver, specifically when handling Link Aggregation Group (LAG) devices, which can lead to system crashes under certain conditions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mlx5 driver related to the handling of LAG devices within network bridges. When a LAG device is removed from a bridge, the system triggers a NETDEV_CHANGEUPPER event. If one of the physical functions (PFs) associated with the LAG is unloaded, the driver fails to properly handle the flush of offloaded entries, leading to a NULL return value instead of the active PF. This oversight can cause the bridge's forwarding database (FDB) entries to remain alive without proper updates, ultimately resulting in a crash when the system attempts to access a destroyed network device. The vulnerability is exacerbated by the continuous sending of events by the mlx5 bridge workqueue, which can lead to instability and crashes in the kernel.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2025-21970 vulnerability in the Linux kernel's mlx5 driver poses a significant risk of system crashes due to improper handling of LAG devices in network bridges. Users are encouraged to update their systems to the patched version to ensure stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The impact includes potential system crashes when handling LAG devices in network bridges, leading to instability in network operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor for updates and apply them as soon as they are available to mitigate risks.
Yes, this vulnerability affects the Linux kernel in Debian distributions, specifically versions 12 and 13.
The NETDEV_CHANGEUPPER event is triggered when a network device's upper layer is changed, which is critical for managing network interfaces and their states.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
