Critical Vulnerability in Linux Kernel: Negative Offset Issue in HWS_SET32 Macro
Summary
DEBIAN-CVE-2025-21800: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix definer's HWS_SET32 macro for negative offset When bit offset for HWS_SET32 macro is negative, UBSAN complains about the shift-out-of... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various distributions, including Debian. The kernel is responsible for managing system resources, enabling hardware communication, and ensuring security. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically related to the mlx5 driver, which is used for Mellanox Ethernet devices.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the net/mlx5 driver related to the HWS_SET32 macro. When the bit offset for this macro is negative, it triggers a shift-out-of-bounds error reported by UBSAN (Undefined Behavior Sanitizer). This can lead to unexpected behavior in the kernel, potentially allowing for exploitation or system instability. The issue was found in the file drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c at line 177.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the package as mentioned above.
Conclusion
The vulnerability identified in the Linux kernel's mlx5 driver poses a significant risk due to its potential to cause system instability. Users are strongly advised to update their systems to the patched version to ensure protection against this issue.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to a negative offset in the HWS_SET32 macro within the mlx5 driver, causing a shift-out-of-bounds error.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.13-1.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability could lead to system instability or unexpected behavior, which may compromise system security.
The most effective way to mitigate the risk is to update to the patched version of the Linux kernel. No specific workarounds are available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
