Critical Vulnerability in Linux Kernel: Memory Dereference Issue in mlx5e Driver
Summary
DEBIAN-CVE-2025-38590: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing the essential interface between hardware and software. It is responsible for managing system resources and facilitating communication between hardware components and applications. The kernel is modular, allowing for the addition of various drivers, including the mlx5e driver, which supports Mellanox Ethernet devices. This driver is crucial for high-performance networking, but it is susceptible to vulnerabilities that can lead to system crashes and security breaches.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the mlx5e driver related to the handling of decrypted packets. When the hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. If the state has been freed by the time of this lookup, the secpath extension on the skb is not removed, leading to a crash when downstream functions attempt to access invalid state pointers. This issue can cause system instability and potential denial of service, as it allows for dereferencing a null or invalid pointer, resulting in a kernel panic.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, it is advisable to monitor system logs for any unusual behavior and to apply the patch as soon as it is available.
Conclusion
The identified vulnerability in the Linux kernel's mlx5e driver poses significant risks to system stability and security. It is crucial for users to update their systems to the patched versions to mitigate these risks. Regular monitoring and prompt updates are essential to maintaining a secure environment.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a memory dereference issue in the mlx5e driver, which can lead to system crashes.
You can use the Vulert platform to check if your application is affected by this vulnerability without requiring access to the code or installation.
Exploitation of this vulnerability can lead to system instability, crashes, and potential denial of service.
Yes, patches are available for Debian 13 and 14. Ensure to update to the specified patched versions.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
