CVE-2025-40350 (GCVE-0-2025-40350)
Vulnerability from cvelistv5 – Published: 2025-12-16 13:30 – Updated: 2026-08-05 12:09
VLAI
EPSS
VEX
Title
net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ
XDP programs can change the layout of an xdp_buff through
bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver
cannot assume the size of the linear data area nor fragments. Fix the
bug in mlx5 by generating skb according to xdp_buff after XDP programs
run.
Currently, when handling multi-buf XDP, the mlx5 driver assumes the
layout of an xdp_buff to be unchanged. That is, the linear data area
continues to be empty and fragments remain the same. This may cause
the driver to generate erroneous skb or triggering a kernel
warning. When an XDP program added linear data through
bpf_xdp_adjust_head(), the linear data will be ignored as
mlx5e_build_linear_skb() builds an skb without linear data and then
pull data from fragments to fill the linear data area. When an XDP
program has shrunk the non-linear data through bpf_xdp_adjust_tail(),
the delta passed to __pskb_pull_tail() may exceed the actual nonlinear
data size and trigger the BUG_ON in it.
To fix the issue, first record the original number of fragments. If the
number of fragments changes after the XDP program runs, rewind the end
fragment pointer by the difference and recalculate the truesize. Then,
build the skb with the linear data area matching the xdp_buff. Finally,
only pull data in if there is non-linear data and fill the linear part
up to 256 bytes.
Severity
9.8 (Critical)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
f52ac7028bec22e925c8fece4f21641eb13b4d6f , < 8b051d7f530e8a5237da242fbeafef02fec6b813
(git)
Affected: f52ac7028bec22e925c8fece4f21641eb13b4d6f , < cb9edd583e23979ee546981be963ad5f217e8b18 (git) Affected: f52ac7028bec22e925c8fece4f21641eb13b4d6f , < f2557d7fa38e9475b38588f5c124476091480f53 (git) Affected: f52ac7028bec22e925c8fece4f21641eb13b4d6f , < 87bcef158ac1faca1bd7e0104588e8e2956d10be (git) |
guessed | |
| Linux | Linux |
Affected:
6.4
Unaffected: 0 , < 6.4 (semver) Unaffected: 6.6.115 , ≤ 6.6.* (semver) Unaffected: 6.12.56 , ≤ 6.12.* (semver) Unaffected: 6.17.6 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8b051d7f530e8a5237da242fbeafef02fec6b813",
"status": "affected",
"version": "f52ac7028bec22e925c8fece4f21641eb13b4d6f",
"versionType": "git"
},
{
"lessThan": "cb9edd583e23979ee546981be963ad5f217e8b18",
"status": "affected",
"version": "f52ac7028bec22e925c8fece4f21641eb13b4d6f",
"versionType": "git"
},
{
"lessThan": "f2557d7fa38e9475b38588f5c124476091480f53",
"status": "affected",
"version": "f52ac7028bec22e925c8fece4f21641eb13b4d6f",
"versionType": "git"
},
{
"lessThan": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"status": "affected",
"version": "f52ac7028bec22e925c8fece4f21641eb13b4d6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.115",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.56",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ\n\nXDP programs can change the layout of an xdp_buff through\nbpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver\ncannot assume the size of the linear data area nor fragments. Fix the\nbug in mlx5 by generating skb according to xdp_buff after XDP programs\nrun.\n\nCurrently, when handling multi-buf XDP, the mlx5 driver assumes the\nlayout of an xdp_buff to be unchanged. That is, the linear data area\ncontinues to be empty and fragments remain the same. This may cause\nthe driver to generate erroneous skb or triggering a kernel\nwarning. When an XDP program added linear data through\nbpf_xdp_adjust_head(), the linear data will be ignored as\nmlx5e_build_linear_skb() builds an skb without linear data and then\npull data from fragments to fill the linear data area. When an XDP\nprogram has shrunk the non-linear data through bpf_xdp_adjust_tail(),\nthe delta passed to __pskb_pull_tail() may exceed the actual nonlinear\ndata size and trigger the BUG_ON in it.\n\nTo fix the issue, first record the original number of fragments. If the\nnumber of fragments changes after the XDP program runs, rewind the end\nfragment pointer by the difference and recalculate the truesize. Then,\nbuild the skb with the linear data area matching the xdp_buff. Finally,\nonly pull data in if there is non-linear data and fill the linear part\nup to 256 bytes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is the mlx5e RX packet-processing path, executed on every received frame during NAPI poll, and is triggered purely by an inbound packet whose size and content the remote sender controls. Jumbo-MTU routed fabrics (the configuration in which this non-linear XDP path is used at all) are standard in datacenter/cloud networks, so the attacker need not be on the same L2 segment.\nAC:L - Given a vulnerable host (mlx5 + striding RQ + jumbo MTU + multi-buf XDP program), the attacker reliably triggers the bug by sending a multi-buffer-sized frame that the XDP program grows or trims; no race, no memory-layout guessing, and the trigger can be repeated at line rate.\nPR:N - No credentials, account, or capability on the target are required \u2014 the attacker only has to place packets on the wire, and the code runs before any authentication or socket-layer authorization.\nUI:N - Packet reception and XDP program execution happen automatically in softirq context; no action by any local user or administrator is needed at attack time.\nS:U - The corrupted page-pool pages, skb metadata, and the BUG_ON all reside within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The skb retains fragment references to pages already returned to the page pool, and the reference-count underflow lets those pages be recycled as fresh RX buffers while still referenced \u2014 a use-after-free that exposes other packets\u0027 (other tenants\u0027/hosts\u0027) data through the mis-built skb, which may be delivered locally or forwarded back onto the network.\nI:H - Page-pool refcount underflow and re-use of freed RX pages constitute memory corruption exploitable for heap manipulation, and the skb is built with a bogus linear area/length and over-counted fragments, silently corrupting packet data delivered to the stack.\nA:H - When the XDP program shrinks the packet below 256 bytes or frees all fragments, the stale headlen passed to __pskb_pull_tail() makes skb_copy_bits() fail and hits its BUG_ON, panicking the kernel; the page-pool refcount corruption independently causes WARNs and use-after-free crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:09:50.275Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8b051d7f530e8a5237da242fbeafef02fec6b813"
},
{
"url": "https://git.kernel.org/stable/c/cb9edd583e23979ee546981be963ad5f217e8b18"
},
{
"url": "https://git.kernel.org/stable/c/f2557d7fa38e9475b38588f5c124476091480f53"
},
{
"url": "https://git.kernel.org/stable/c/87bcef158ac1faca1bd7e0104588e8e2956d10be"
}
],
"title": "net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40350",
"datePublished": "2025-12-16T13:30:23.896Z",
"dateReserved": "2025-04-16T07:20:57.187Z",
"dateUpdated": "2026-08-05T12:09:50.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-40350",
"date": "2026-09-17",
"epss": "0.00543",
"percentile": "0.44337"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-40350\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:46.840\",\"lastModified\":\"2026-07-30T06:24:30.907\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ\\n\\nXDP programs can change the layout of an xdp_buff through\\nbpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver\\ncannot assume the size of the linear data area nor fragments. Fix the\\nbug in mlx5 by generating skb according to xdp_buff after XDP programs\\nrun.\\n\\nCurrently, when handling multi-buf XDP, the mlx5 driver assumes the\\nlayout of an xdp_buff to be unchanged. That is, the linear data area\\ncontinues to be empty and fragments remain the same. This may cause\\nthe driver to generate erroneous skb or triggering a kernel\\nwarning. When an XDP program added linear data through\\nbpf_xdp_adjust_head(), the linear data will be ignored as\\nmlx5e_build_linear_skb() builds an skb without linear data and then\\npull data from fragments to fill the linear data area. When an XDP\\nprogram has shrunk the non-linear data through bpf_xdp_adjust_tail(),\\nthe delta passed to __pskb_pull_tail() may exceed the actual nonlinear\\ndata size and trigger the BUG_ON in it.\\n\\nTo fix the issue, first record the original number of fragments. If the\\nnumber of fragments changes after the XDP program runs, rewind the end\\nfragment pointer by the difference and recalculate the truesize. Then,\\nbuild the skb with the linear data area matching the xdp_buff. Finally,\\nonly pull data in if there is non-linear data and fill the linear part\\nup to 256 bytes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f52ac7028bec22e925c8fece4f21641eb13b4d6f\",\"lessThan\":\"8b051d7f530e8a5237da242fbeafef02fec6b813\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f52ac7028bec22e925c8fece4f21641eb13b4d6f\",\"lessThan\":\"cb9edd583e23979ee546981be963ad5f217e8b18\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f52ac7028bec22e925c8fece4f21641eb13b4d6f\",\"lessThan\":\"f2557d7fa38e9475b38588f5c124476091480f53\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f52ac7028bec22e925c8fece4f21641eb13b4d6f\",\"lessThan\":\"87bcef158ac1faca1bd7e0104588e8e2956d10be\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.115\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.56\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.6\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/87bcef158ac1faca1bd7e0104588e8e2956d10be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8b051d7f530e8a5237da242fbeafef02fec6b813\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb9edd583e23979ee546981be963ad5f217e8b18\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2557d7fa38e9475b38588f5c124476091480f53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-14T18:44:01+00:00",
"cve": "CVE-2025-40350",
"id": "CVE-2025-40350",
"initial_release_date": "2025-12-16T00:00:00+00:00",
"product_status:known_affected": "198",
"product_status:known_not_affected": "76",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40350.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…