Critical Vulnerability in Linux Kernel: UAF Issue in mlx5 Driver
Summary
DEBIAN-CVE-2025-38109: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on the embedded chip (ECVF) of a BlueField de... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of functionalities, including process management, memory management, and device drivers. The mlx5 driver is specifically designed for Mellanox devices, enabling high-performance networking capabilities. However, a recent vulnerability has been identified that affects the shutdown flow of virtual functions on BlueField devices, leading to potential use-after-free (UAF) issues.
Vulnerability Detail
In the Linux kernel, a vulnerability has been discovered in the mlx5 driver related to the handling of ECVF (Embedded Chip Virtual Function) vports during the shutdown process. This issue arises when a virtual function is created on a BlueField device, causing the vport ACL ingress table not to be properly destroyed. The vulnerability can lead to a use-after-free condition, resulting in a refcount_t underflow and potential system instability. The kernel log indicates a warning triggered during the shutdown sequence, which could be exploited to execute arbitrary code or crash the system.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using ECVF vports until the system is updated to the patched version. This may involve disabling certain features or configurations that rely on ECVF functionality.
Conclusion
The identified vulnerability in the Linux kernel's mlx5 driver poses significant risks related to the shutdown flow of ECVF vports. Users are strongly advised to update their systems to the patched version to mitigate potential exploitation. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to arbitrary code execution or crashes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your package-lock.json file, you can check for vulnerabilities without needing to access the code.
Failing to address this vulnerability could lead to system instability, unauthorized access, or exploitation by malicious actors, potentially compromising sensitive data.
Yes, temporarily disabling ECVF vports can mitigate the risk until the system is updated to the patched version.
Detailed information can be found in the official Debian CVE database or by visiting the Vulert website for real-time monitoring of vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
