Information Disclosure and Denial of Service Vulnerability in DPDK Package
Summary
DEBIAN-CVE-2025-23259: NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface. Affects dpdk versions < 24.11.3-1~deb13u1. Fixed in 24.11.3-1~deb13u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Data Plane Development Kit (DPDK) is a set of libraries and drivers for fast packet processing. It is widely used in networking applications to enhance performance and efficiency. The DPDK package is crucial for applications that require high-speed data transmission and processing. However, it is susceptible to vulnerabilities that can compromise the integrity and availability of network interfaces.
Vulnerability Detail
NVIDIA Mellanox DPDK contains a vulnerability in the Poll Mode Driver (PMD). This flaw allows an attacker on a virtual machine (VM) within the system to potentially cause information disclosure and denial of service on the network interface. The vulnerability arises from improper handling of certain operations, which can lead to unauthorized access to sensitive information and disrupt network services.
How To Fix
Minimum fixed version
24.11.3-1~deb13u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dpdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the network interface or isolate vulnerable VMs to mitigate the risk of exploitation until the package is updated.
Conclusion
The DPDK package is critical for high-performance networking applications but is currently affected by a vulnerability that could lead to serious security issues. Users are advised to update to the latest patched versions to mitigate risks. For ongoing monitoring, tools like Vulert can provide real-time alerts for vulnerabilities in open-source software.
See every vulnerability recorded for dpdk →
FAQ
DPDK stands for Data Plane Development Kit, which is a set of libraries and drivers for fast packet processing.
The vulnerability allows an attacker on a VM to cause information disclosure and denial of service on the network interface.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Consider isolating vulnerable VMs or limiting access to the affected network interfaces as a temporary workaround.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-23259.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for dpdk.
