Kernel Vulnerability in Linux Package: MQPRIO Configuration Issue
Summary
DEBIAN-CVE-2025-38039: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled When attempting to enable MQPRIO while HTB offload is already configured, the... Affects linux versions < 6.12.32-1. Fixed in 6.12.32-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the operating system and is crucial for system stability and performance. The vulnerability identified in this report affects the Linux package versions 6.12.32-1 in Debian 13 and 14, specifically related to the configuration of Multi-Queue Priority (MQPRIO) with Hierarchical Token Bucket (HTB) offload enabled.
Vulnerability Detail
In the Linux kernel, a vulnerability was discovered in the net/mlx5e driver that occurs when attempting to enable MQPRIO while HTB offload is already configured. The driver incorrectly returns an error code of -EINVAL and triggers a WARN_ON, which leads to an unnecessary call trace. This behavior can cause confusion for users and complicate debugging efforts, as it generates excessive log output without providing a clear resolution.
How To Fix
Minimum fixed version
6.12.32-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no specific workaround provided for this vulnerability. However, users are advised to avoid enabling MQPRIO when HTB offload is already configured until the package is updated.
Conclusion
In summary, the vulnerability identified in the Linux kernel regarding MQPRIO configuration can lead to unnecessary warnings and complicate system management. Users are encouraged to update their Linux packages to the latest version to mitigate this issue.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to unnecessary log messages and confusion during the configuration of MQPRIO with HTB offload, potentially complicating troubleshooting efforts.
You can check if your system is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
If an immediate update is not possible, avoid enabling MQPRIO when HTB offload is configured to prevent triggering the vulnerability.
No, this vulnerability does not directly cause data loss; however, it may lead to confusion and complicate system management.
More information can be found in the official Debian CVE database or by visiting the source link provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
