Critical MACsec Offload Vulnerability in Linux Kernel - CVE-2025-38020
Summary
CVE-2025-38020: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports a variety of functionalities, including networking, file systems, and process management. The vulnerability CVE-2025-38020 specifically affects the mlx5e driver, which is responsible for managing network devices that utilize the Mellanox hardware. This vulnerability arises from improper handling of MACsec offload features in switchdev mode, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, the vulnerability CVE-2025-38020 is due to the MACsec offload feature being incorrectly enabled for uplink representor profiles in switchdev mode. When this feature is active, it can lead to a null pointer dereference, causing a general protection fault. This issue can result in system instability, crashes, and potential denial of service, as the kernel fails to manage the network device correctly when the MACsec offload is attempted. The vulnerability is particularly critical as it can be exploited during network operations, impacting the reliability of the system.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the MACsec offload feature manually until the kernel is updated. This can be done by clearing the NETIF_F_HW_MACSEC feature in the network device settings. However, this is not a permanent solution and users are encouraged to apply the patch as soon as possible.
Conclusion
The CVE-2025-38020 vulnerability in the Linux kernel poses significant risks due to improper handling of MACsec offload features. Users are strongly advised to update their kernel packages to the patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38020 is a vulnerability in the Linux kernel that affects the MACsec offload feature in switchdev mode, potentially leading to system crashes.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability can lead to a null pointer dereference, causing system instability and potential denial of service.
You can update your Linux kernel to the fixed versions (6.1.140-1 for Debian 12 and 6.12.30-1 for Debian 13) using the apt-get command as shown in the 'how to fix' section.
Yes, you can temporarily disable the MACsec offload feature until the kernel is updated, but this is not a permanent solution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
