CVE-2025-38590 (GCVE-0-2025-38590)

Vulnerability from cvelistv5 – Published: 2025-08-19 17:03 – Updated: 2026-08-05 12:03
VLAI
Title
net/mlx5e: Remove skb secpath if xfrm state is not found
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup. Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0. Subsequently, functions like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer. This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath. BUG: unable to handle page fault for address: ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__xfrm_policy_check+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ? udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410 __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530 udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130 ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130 ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210 mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170 net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0 handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0 </IRQ>
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b2ac7541e3777f325c49d900550c9e3dd10c0eda , < 314f568b84b01f6eac1e4313ca47f9ade4349443 (git)
Affected: b2ac7541e3777f325c49d900550c9e3dd10c0eda , < 781a0bbf377443ef06f3248221f06cb555935530 (git)
Affected: b2ac7541e3777f325c49d900550c9e3dd10c0eda , < 3a5782431d84716b66302b07ff1b32fea1023bd5 (git)
Affected: b2ac7541e3777f325c49d900550c9e3dd10c0eda , < 137b12a4900eb6971b889839eab6036f72cbb217 (git)
Affected: b2ac7541e3777f325c49d900550c9e3dd10c0eda , < 6d19c44b5c6dd72f9a357d0399604ec16a77de3c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 6.6.102 , ≤ 6.6.* (semver)
Unaffected: 6.12.42 , ≤ 6.12.* (semver)
Unaffected: 6.15.10 , ≤ 6.15.* (semver)
Unaffected: 6.16.1 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "314f568b84b01f6eac1e4313ca47f9ade4349443",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "781a0bbf377443ef06f3248221f06cb555935530",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "3a5782431d84716b66302b07ff1b32fea1023bd5",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "137b12a4900eb6971b889839eab6036f72cbb217",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "6d19c44b5c6dd72f9a357d0399604ec16a77de3c",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Remove skb secpath if xfrm state is not found\n\nHardware returns a unique identifier for a decrypted packet\u0027s xfrm\nstate, this state is looked up in an xarray. However, the state might\nhave been freed by the time of this lookup.\n\nCurrently, if the state is not found, only a counter is incremented.\nThe secpath (sp) extension on the skb is not removed, resulting in\nsp-\u003elen becoming 0.\n\nSubsequently, functions like __xfrm_policy_check() attempt to access\nfields such as xfrm_input_state(skb)-\u003exso.type (which dereferences\nsp-\u003exvec[sp-\u003elen - 1]) without first validating sp-\u003elen. This leads to\na crash when dereferencing an invalid state pointer.\n\nThis patch prevents the crash by explicitly removing the secpath\nextension from the skb if the xfrm state is not found after hardware\ndecryption. This ensures downstream functions do not operate on a\nzero-length secpath.\n\n BUG: unable to handle page fault for address: ffffffff000002c8\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 282e067 P4D 282e067 PUD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__xfrm_policy_check+0x61a/0xa30\n Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 \u003c0f\u003e b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa\n RSP: 0018:ffff88885fb04918 EFLAGS: 00010297\n RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000\n RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000\n RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353\n R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8\n R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00\n FS:  0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cIRQ\u003e\n  ? try_to_wake_up+0x108/0x4c0\n  ? udp4_lib_lookup2+0xbe/0x150\n  ? udp_lib_lport_inuse+0x100/0x100\n  ? __udp4_lib_lookup+0x2b0/0x410\n  __xfrm_policy_check2.constprop.0+0x11e/0x130\n  udp_queue_rcv_one_skb+0x1d/0x530\n  udp_unicast_rcv_skb+0x76/0x90\n  __udp4_lib_rcv+0xa64/0xe90\n  ip_protocol_deliver_rcu+0x20/0x130\n  ip_local_deliver_finish+0x75/0xa0\n  ip_local_deliver+0xc1/0xd0\n  ? ip_protocol_deliver_rcu+0x130/0x130\n  ip_sublist_rcv+0x1f9/0x240\n  ? ip_rcv_finish_core+0x430/0x430\n  ip_list_rcv+0xfc/0x130\n  __netif_receive_skb_list_core+0x181/0x1e0\n  netif_receive_skb_list_internal+0x200/0x360\n  ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core]\n  gro_receive_skb+0xfd/0x210\n  mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core]\n  mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core]\n  ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core]\n  mlx5e_napi_poll+0x114/0xab0 [mlx5_core]\n  __napi_poll+0x25/0x170\n  net_rx_action+0x32d/0x3a0\n  ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core]\n  ? notifier_call_chain+0x33/0xa0\n  handle_softirqs+0xda/0x250\n  irq_exit_rcu+0x6d/0xc0\n  common_interrupt+0x81/0xa0\n  \u003c/IRQ\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is triggered purely by receiving network packets \u2014 ESP traffic decrypted by the mlx5 NIC\u0027s IPsec offload engine and processed in `mlx5e_build_rx_skb()`/NAPI. No local access to the target is needed; a remote peer on the IPsec tunnel drives the entire condition.\nAC:L - The attacker controls both sides of the race: it can force the SA teardown (IKE rekey or CREATE_CHILD_SA/DELETE, or driving hard lifetime expiry) while flooding ESP packets on the old SA, and the window between `xdo_dev_state_delete` (xarray erase) and `xdo_dev_state_free` (HW rule removal, deferred through refcount drop and the state GC workqueue) spans milliseconds during which every packet on that SA deterministically hits the miss path.\nPR:N - The attacker needs no account, capability, or any privilege on the target host \u2014 it acts purely as a remote network peer sending traffic and IKE control messages. This matches the scoring of the directly analogous mlx5e IPsec RX-path race (CVE-2026-23440, PR:N).\nUI:N - No victim action is required; the crash occurs autonomously in softirq context while processing received packets during routine SA teardown/rekey.\nS:U - The out-of-bounds read and the resulting fault are entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The `sp-\u003exvec[-1]` access is a bounded 8-byte read of the skb_ext header padding within the same allocation, and the subsequent 1-byte wild dereference only feeds a boolean that has no effect (`secpath_has_nontransport()` over a zero-length secpath returns 0 either way); no data is ever returned to or observable by the attacker.\nI:N - There is no write primitive \u2014 the bug is a read of an uninitialized pointer followed by a load. With `sp-\u003elen == 0` the policy check fails closed (empty secpath fails template matching), so no packet is wrongly accepted through the xfrm policy engine.\nA:H - Dereferencing the garbage pointer faults on an unmapped address inside NAPI/softirq context (`Comm: swapper/N`, `\u003cIRQ\u003e`), producing a fatal exception in interrupt and a full kernel panic, repeatable on every SA teardown under traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:12.608Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/314f568b84b01f6eac1e4313ca47f9ade4349443"
        },
        {
          "url": "https://git.kernel.org/stable/c/781a0bbf377443ef06f3248221f06cb555935530"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a5782431d84716b66302b07ff1b32fea1023bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/137b12a4900eb6971b889839eab6036f72cbb217"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d19c44b5c6dd72f9a357d0399604ec16a77de3c"
        }
      ],
      "title": "net/mlx5e: Remove skb secpath if xfrm state is not found",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38590",
    "datePublished": "2025-08-19T17:03:11.691Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-08-05T12:03:12.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38590",
      "date": "2026-09-23",
      "epss": "0.00364",
      "percentile": "0.3031"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-09T01:49:14.000Z",
      "cve": "CVE-2025-38590",
      "id": "msrc_CVE-2025-38590",
      "initial_release_date": "2025-09-04T02:47:43.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "7",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/mlx5e: Remove skb secpath if xfrm state is not found",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38590.json",
      "version": "7"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "314f568b84b01f6eac1e4313ca47f9ade4349443",
                    "status": "affected",
                    "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "781a0bbf377443ef06f3248221f06cb555935530",
                    "status": "affected",
                    "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3a5782431d84716b66302b07ff1b32fea1023bd5",
                    "status": "affected",
                    "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "137b12a4900eb6971b889839eab6036f72cbb217",
                    "status": "affected",
                    "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d19c44b5c6dd72f9a357d0399604ec16a77de3c",
                    "status": "affected",
                    "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.9"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.102",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.15.*",
                    "status": "unaffected",
                    "version": "6.15.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "85D3C82A-E9CC-406F-B831-7B0D594116C0",
                    "versionEndExcluding": "6.6.102",
                    "versionStartIncluding": "5.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EA7AA5E6-4376-4A85-A021-6ACC5FF801C3",
                    "versionEndExcluding": "6.12.42",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5890C690-B295-40C2-9121-FF5F987E5142",
                    "versionEndExcluding": "6.15.10",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB",
                    "versionEndExcluding": "6.16.1",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Remove skb secpath if xfrm state is not found\n\nHardware returns a unique identifier for a decrypted packet\u0027s xfrm\nstate, this state is looked up in an xarray. However, the state might\nhave been freed by the time of this lookup.\n\nCurrently, if the state is not found, only a counter is incremented.\nThe secpath (sp) extension on the skb is not removed, resulting in\nsp-\u003elen becoming 0.\n\nSubsequently, functions like __xfrm_policy_check() attempt to access\nfields such as xfrm_input_state(skb)-\u003exso.type (which dereferences\nsp-\u003exvec[sp-\u003elen - 1]) without first validating sp-\u003elen. This leads to\na crash when dereferencing an invalid state pointer.\n\nThis patch prevents the crash by explicitly removing the secpath\nextension from the skb if the xfrm state is not found after hardware\ndecryption. This ensures downstream functions do not operate on a\nzero-length secpath.\n\n BUG: unable to handle page fault for address: ffffffff000002c8\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 282e067 P4D 282e067 PUD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__xfrm_policy_check+0x61a/0xa30\n Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 \u003c0f\u003e b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa\n RSP: 0018:ffff88885fb04918 EFLAGS: 00010297\n RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000\n RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000\n RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353\n R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8\n R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00\n FS:  0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cIRQ\u003e\n  ? try_to_wake_up+0x108/0x4c0\n  ? udp4_lib_lookup2+0xbe/0x150\n  ? udp_lib_lport_inuse+0x100/0x100\n  ? __udp4_lib_lookup+0x2b0/0x410\n  __xfrm_policy_check2.constprop.0+0x11e/0x130\n  udp_queue_rcv_one_skb+0x1d/0x530\n  udp_unicast_rcv_skb+0x76/0x90\n  __udp4_lib_rcv+0xa64/0xe90\n  ip_protocol_deliver_rcu+0x20/0x130\n  ip_local_deliver_finish+0x75/0xa0\n  ip_local_deliver+0xc1/0xd0\n  ? ip_protocol_deliver_rcu+0x130/0x130\n  ip_sublist_rcv+0x1f9/0x240\n  ? ip_rcv_finish_core+0x430/0x430\n  ip_list_rcv+0xfc/0x130\n  __netif_receive_skb_list_core+0x181/0x1e0\n  netif_receive_skb_list_internal+0x200/0x360\n  ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core]\n  gro_receive_skb+0xfd/0x210\n  mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core]\n  mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core]\n  ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core]\n  mlx5e_napi_poll+0x114/0xab0 [mlx5_core]\n  __napi_poll+0x25/0x170\n  net_rx_action+0x32d/0x3a0\n  ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core]\n  ? notifier_call_chain+0x33/0xa0\n  handle_softirqs+0xda/0x250\n  irq_exit_rcu+0x6d/0xc0\n  common_interrupt+0x81/0xa0\n  \u003c/IRQ\u003e"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5e: Eliminar secpath de skb si no se encuentra el estado xfrm El hardware devuelve un identificador \u00fanico para el estado xfrm de un paquete descifrado, este estado se busca en un xarray. Sin embargo, el estado podr\u00eda haberse liberado en el momento de esta b\u00fasqueda. Actualmente, si no se encuentra el estado, solo se incrementa un contador. La extensi\u00f3n secpath (sp) en skb no se elimina, lo que hace que sp-\u0026gt;len se convierta en 0. Posteriormente, funciones como __xfrm_policy_check() intentan acceder a campos como xfrm_input_state(skb)-\u0026gt;xso.type (que desreferencia sp-\u0026gt;xvec[sp-\u0026gt;len - 1]) sin validar primero sp-\u0026gt;len. Esto provoca un fallo al desreferenciar un puntero de estado no v\u00e1lido. Este parche evita el fallo eliminando expl\u00edcitamente la extensi\u00f3n secpath de skb si no se encuentra el estado xfrm despu\u00e9s del descifrado del hardware. Esto garantiza que las funciones posteriores no operen en un secpath de longitud cero. ERROR: no se puede manejar el error de p\u00e1gina para la direcci\u00f3n: ffffffff000002c8 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 No contaminado 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NINGUNO Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__xfrm_policy_check+0x61a/0xa30 C\u00f3digo: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 \u0026lt;0f\u0026gt; b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 00000000000000002 RDI: 00000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:00000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Rastreo de llamadas:  ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ? udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410 __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530 udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130 ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130 ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210 mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170 net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0 handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0  "
          }
        ],
        "id": "CVE-2025-38590",
        "lastModified": "2026-07-30T06:23:28.897",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-08-19T17:15:36.653",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/137b12a4900eb6971b889839eab6036f72cbb217"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/314f568b84b01f6eac1e4313ca47f9ade4349443"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3a5782431d84716b66302b07ff1b32fea1023bd5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6d19c44b5c6dd72f9a357d0399604ec16a77de3c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/781a0bbf377443ef06f3248221f06cb555935530"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-16T18:29:49+00:00",
      "cve": "CVE-2025-38590",
      "id": "CVE-2025-38590",
      "initial_release_date": "2025-08-19T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Remove skb secpath if xfrm state is not found",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38590.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.