CVE-2025-38109 (GCVE-0-2025-38109)
Vulnerability from cvelistv5 – Published: 2025-07-03 08:35 – Updated: 2026-06-11 18:44
VLAI
EPSS
VEX
Title
net/mlx5: Fix ECVF vports unload on shutdown flow
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix ECVF vports unload on shutdown flow
Fix shutdown flow UAF when a virtual function is created on the embedded
chip (ECVF) of a BlueField device. In such case the vport acl ingress
table is not properly destroyed.
ECVF functionality is independent of ecpf_vport_exists capability and
thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not
test it when enabling/disabling ECVF vports.
kernel log:
[] refcount_t: underflow; use-after-free.
[] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28
refcount_warn_saturate+0x124/0x220
----------------
[] Call trace:
[] refcount_warn_saturate+0x124/0x220
[] tree_put_node+0x164/0x1e0 [mlx5_core]
[] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]
[] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]
[] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core]
[] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core]
[] esw_vport_cleanup+0x64/0x90 [mlx5_core]
[] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core]
[] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core]
[] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core]
[] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core]
[] mlx5_sriov_detach+0x40/0x50 [mlx5_core]
[] mlx5_unload+0x40/0xc4 [mlx5_core]
[] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core]
[] mlx5_unload_one+0x3c/0x60 [mlx5_core]
[] shutdown+0x7c/0xa4 [mlx5_core]
[] pci_device_shutdown+0x3c/0xa0
[] device_shutdown+0x170/0x340
[] __do_sys_reboot+0x1f4/0x2a0
[] __arm64_sys_reboot+0x2c/0x40
[] invoke_syscall+0x78/0x100
[] el0_svc_common.constprop.0+0x54/0x184
[] do_el0_svc+0x30/0xac
[] el0_svc+0x48/0x160
[] el0t_64_sync_handler+0xa4/0x12c
[] el0t_64_sync+0x1a4/0x1a8
[] --[ end trace 9c4601d68c70030e ]---
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:42 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
a7719b29a82199b90ebbf355d3332e0fbfbf6045 , < 5953ae44dfe5dbad374318875be834c3b7b71ee6
(git)
Affected: a7719b29a82199b90ebbf355d3332e0fbfbf6045 , < da15ca0553325acf68039015f2f4db750c8e2b96 (git) Affected: a7719b29a82199b90ebbf355d3332e0fbfbf6045 , < 24db585d369f949f698e03d7d8017e5ae19d0497 (git) Affected: a7719b29a82199b90ebbf355d3332e0fbfbf6045 , < 687560d8a9a2d654829ad0da1ec24242f1de711d (git) |
guessed | |
| Linux | Linux |
Affected:
6.5
Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.94 , ≤ 6.6.* (semver) Unaffected: 6.12.34 , ≤ 6.12.* (semver) Unaffected: 6.15.3 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-38109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T20:42:21.677196Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T18:44:22.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5953ae44dfe5dbad374318875be834c3b7b71ee6",
"status": "affected",
"version": "a7719b29a82199b90ebbf355d3332e0fbfbf6045",
"versionType": "git"
},
{
"lessThan": "da15ca0553325acf68039015f2f4db750c8e2b96",
"status": "affected",
"version": "a7719b29a82199b90ebbf355d3332e0fbfbf6045",
"versionType": "git"
},
{
"lessThan": "24db585d369f949f698e03d7d8017e5ae19d0497",
"status": "affected",
"version": "a7719b29a82199b90ebbf355d3332e0fbfbf6045",
"versionType": "git"
},
{
"lessThan": "687560d8a9a2d654829ad0da1ec24242f1de711d",
"status": "affected",
"version": "a7719b29a82199b90ebbf355d3332e0fbfbf6045",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.15.*",
"status": "unaffected",
"version": "6.15.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.16",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.94",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.34",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15.3",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix ECVF vports unload on shutdown flow\n\nFix shutdown flow UAF when a virtual function is created on the embedded\nchip (ECVF) of a BlueField device. In such case the vport acl ingress\ntable is not properly destroyed.\n\nECVF functionality is independent of ecpf_vport_exists capability and\nthus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not\ntest it when enabling/disabling ECVF vports.\n\nkernel log:\n[] refcount_t: underflow; use-after-free.\n[] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28\n refcount_warn_saturate+0x124/0x220\n----------------\n[] Call trace:\n[] refcount_warn_saturate+0x124/0x220\n[] tree_put_node+0x164/0x1e0 [mlx5_core]\n[] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]\n[] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]\n[] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core]\n[] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core]\n[] esw_vport_cleanup+0x64/0x90 [mlx5_core]\n[] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core]\n[] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core]\n[] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core]\n[] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core]\n[] mlx5_sriov_detach+0x40/0x50 [mlx5_core]\n[] mlx5_unload+0x40/0xc4 [mlx5_core]\n[] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core]\n[] mlx5_unload_one+0x3c/0x60 [mlx5_core]\n[] shutdown+0x7c/0xa4 [mlx5_core]\n[] pci_device_shutdown+0x3c/0xa0\n[] device_shutdown+0x170/0x340\n[] __do_sys_reboot+0x1f4/0x2a0\n[] __arm64_sys_reboot+0x2c/0x40\n[] invoke_syscall+0x78/0x100\n[] el0_svc_common.constprop.0+0x54/0x184\n[] do_el0_svc+0x30/0xac\n[] el0_svc+0x48/0x160\n[] el0t_64_sync_handler+0xa4/0x12c\n[] el0t_64_sync+0x1a4/0x1a8\n[] --[ end trace 9c4601d68c70030e ]---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:21:26.013Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5953ae44dfe5dbad374318875be834c3b7b71ee6"
},
{
"url": "https://git.kernel.org/stable/c/da15ca0553325acf68039015f2f4db750c8e2b96"
},
{
"url": "https://git.kernel.org/stable/c/24db585d369f949f698e03d7d8017e5ae19d0497"
},
{
"url": "https://git.kernel.org/stable/c/687560d8a9a2d654829ad0da1ec24242f1de711d"
}
],
"title": "net/mlx5: Fix ECVF vports unload on shutdown flow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-38109",
"datePublished": "2025-07-03T08:35:19.240Z",
"dateReserved": "2025-04-16T04:51:23.985Z",
"dateUpdated": "2026-06-11T18:44:22.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-38109",
"date": "2026-09-14",
"epss": "0.00171",
"percentile": "0.06731"
},
"microsoft_vex": {
"current_release_date": "2026-02-18T01:35:08.000Z",
"cve": "CVE-2025-38109",
"id": "msrc_CVE-2025-38109",
"initial_release_date": "2025-07-02T00:00:00.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "net/mlx5: Fix ECVF vports unload on shutdown flow",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38109.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-38109\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:24.553\",\"lastModified\":\"2026-06-17T09:16:04.400\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Fix ECVF vports unload on shutdown flow\\n\\nFix shutdown flow UAF when a virtual function is created on the embedded\\nchip (ECVF) of a BlueField device. In such case the vport acl ingress\\ntable is not properly destroyed.\\n\\nECVF functionality is independent of ecpf_vport_exists capability and\\nthus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not\\ntest it when enabling/disabling ECVF vports.\\n\\nkernel log:\\n[] refcount_t: underflow; use-after-free.\\n[] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28\\n refcount_warn_saturate+0x124/0x220\\n----------------\\n[] Call trace:\\n[] refcount_warn_saturate+0x124/0x220\\n[] tree_put_node+0x164/0x1e0 [mlx5_core]\\n[] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]\\n[] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]\\n[] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core]\\n[] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core]\\n[] esw_vport_cleanup+0x64/0x90 [mlx5_core]\\n[] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core]\\n[] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core]\\n[] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core]\\n[] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core]\\n[] mlx5_sriov_detach+0x40/0x50 [mlx5_core]\\n[] mlx5_unload+0x40/0xc4 [mlx5_core]\\n[] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core]\\n[] mlx5_unload_one+0x3c/0x60 [mlx5_core]\\n[] shutdown+0x7c/0xa4 [mlx5_core]\\n[] pci_device_shutdown+0x3c/0xa0\\n[] device_shutdown+0x170/0x340\\n[] __do_sys_reboot+0x1f4/0x2a0\\n[] __arm64_sys_reboot+0x2c/0x40\\n[] invoke_syscall+0x78/0x100\\n[] el0_svc_common.constprop.0+0x54/0x184\\n[] do_el0_svc+0x30/0xac\\n[] el0_svc+0x48/0x160\\n[] el0t_64_sync_handler+0xa4/0x12c\\n[] el0t_64_sync+0x1a4/0x1a8\\n[] --[ end trace 9c4601d68c70030e ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: Se corrige la descarga de puertos virtuales de ECVF durante el flujo de apagado. Se corrige el UAF del flujo de apagado cuando se crea una funci\u00f3n virtual en el chip integrado (ECVF) de un dispositivo BlueField. En tal caso, la tabla de entrada ACL del puerto virtual no se destruye correctamente. La funcionalidad de ECVF es independiente de la capacidad ecpf_vport_exists y, por lo tanto, las funciones mlx5_eswitch_(enable|disable)_pf_vf_vports() no deber\u00edan probarla al habilitar o deshabilitar los puertos virtuales de ECVF. Registro del kernel: [] refcount_t: desbordamiento; use-after-free. [] ADVERTENCIA: CPU: 3 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0x124/0x220 ---------------- [] Call trace: [] refcount_warn_saturate+0x124/0x220 [] tree_put_node+0x164/0x1e0 [mlx5_core] [] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core] [] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core] [] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core] [] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core] [] esw_vport_cleanup+0x64/0x90 [mlx5_core] [] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core] [] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core] [] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core] [] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core] [] mlx5_sriov_detach+0x40/0x50 [mlx5_core] [] mlx5_unload+0x40/0xc4 [mlx5_core] [] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core] [] mlx5_unload_one+0x3c/0x60 [mlx5_core] [] shutdown+0x7c/0xa4 [mlx5_core] [] pci_device_shutdown+0x3c/0xa0 [] device_shutdown+0x170/0x340 [] __do_sys_reboot+0x1f4/0x2a0 [] __arm64_sys_reboot+0x2c/0x40 [] invoke_syscall+0x78/0x100 [] el0_svc_common.constprop.0+0x54/0x184 [] do_el0_svc+0x30/0xac [] el0_svc+0x48/0x160 [] el0t_64_sync_handler+0xa4/0x12c [] el0t_64_sync+0x1a4/0x1a8 [] --[ fin de seguimiento 9c4601d68c70030e ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a7719b29a82199b90ebbf355d3332e0fbfbf6045\",\"lessThan\":\"5953ae44dfe5dbad374318875be834c3b7b71ee6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a7719b29a82199b90ebbf355d3332e0fbfbf6045\",\"lessThan\":\"da15ca0553325acf68039015f2f4db750c8e2b96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a7719b29a82199b90ebbf355d3332e0fbfbf6045\",\"lessThan\":\"24db585d369f949f698e03d7d8017e5ae19d0497\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a7719b29a82199b90ebbf355d3332e0fbfbf6045\",\"lessThan\":\"687560d8a9a2d654829ad0da1ec24242f1de711d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.94\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.34\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:42:21.677196Z\",\"id\":\"CVE-2025-38109\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.94\",\"matchCriteriaId\":\"3D3A3F5D-1F88-4BFE-92A6-43E827D27BE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.34\",\"matchCriteriaId\":\"4FFA54AA-CDFE-4591-BD07-72813D0948F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24db585d369f949f698e03d7d8017e5ae19d0497\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5953ae44dfe5dbad374318875be834c3b7b71ee6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/687560d8a9a2d654829ad0da1ec24242f1de711d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da15ca0553325acf68039015f2f4db750c8e2b96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-06-30T00:51:27+00:00",
"cve": "CVE-2025-38109",
"id": "CVE-2025-38109",
"initial_release_date": "2025-07-03T00:00:00+00:00",
"product_status:fixed": "612",
"product_status:known_affected": "22",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: Linux kernel (net/mlx5): Use-after-free in ECVF vports unload leads to denial of service",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38109.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38109\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:42:21.677196Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:39:19.836Z\"}}], \"cna\": {\"title\": \"net/mlx5: Fix ECVF vports unload on shutdown flow\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a7719b29a82199b90ebbf355d3332e0fbfbf6045\", \"lessThan\": \"5953ae44dfe5dbad374318875be834c3b7b71ee6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a7719b29a82199b90ebbf355d3332e0fbfbf6045\", \"lessThan\": \"da15ca0553325acf68039015f2f4db750c8e2b96\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a7719b29a82199b90ebbf355d3332e0fbfbf6045\", \"lessThan\": \"24db585d369f949f698e03d7d8017e5ae19d0497\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a7719b29a82199b90ebbf355d3332e0fbfbf6045\", \"lessThan\": \"687560d8a9a2d654829ad0da1ec24242f1de711d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.94\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.34\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5953ae44dfe5dbad374318875be834c3b7b71ee6\"}, {\"url\": \"https://git.kernel.org/stable/c/da15ca0553325acf68039015f2f4db750c8e2b96\"}, {\"url\": \"https://git.kernel.org/stable/c/24db585d369f949f698e03d7d8017e5ae19d0497\"}, {\"url\": \"https://git.kernel.org/stable/c/687560d8a9a2d654829ad0da1ec24242f1de711d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Fix ECVF vports unload on shutdown flow\\n\\nFix shutdown flow UAF when a virtual function is created on the embedded\\nchip (ECVF) of a BlueField device. In such case the vport acl ingress\\ntable is not properly destroyed.\\n\\nECVF functionality is independent of ecpf_vport_exists capability and\\nthus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not\\ntest it when enabling/disabling ECVF vports.\\n\\nkernel log:\\n[] refcount_t: underflow; use-after-free.\\n[] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28\\n refcount_warn_saturate+0x124/0x220\\n----------------\\n[] Call trace:\\n[] refcount_warn_saturate+0x124/0x220\\n[] tree_put_node+0x164/0x1e0 [mlx5_core]\\n[] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]\\n[] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]\\n[] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core]\\n[] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core]\\n[] esw_vport_cleanup+0x64/0x90 [mlx5_core]\\n[] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core]\\n[] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core]\\n[] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core]\\n[] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core]\\n[] mlx5_sriov_detach+0x40/0x50 [mlx5_core]\\n[] mlx5_unload+0x40/0xc4 [mlx5_core]\\n[] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core]\\n[] mlx5_unload_one+0x3c/0x60 [mlx5_core]\\n[] shutdown+0x7c/0xa4 [mlx5_core]\\n[] pci_device_shutdown+0x3c/0xa0\\n[] device_shutdown+0x170/0x340\\n[] __do_sys_reboot+0x1f4/0x2a0\\n[] __arm64_sys_reboot+0x2c/0x40\\n[] invoke_syscall+0x78/0x100\\n[] el0_svc_common.constprop.0+0x54/0x184\\n[] do_el0_svc+0x30/0xac\\n[] el0_svc+0x48/0x160\\n[] el0t_64_sync_handler+0xa4/0x12c\\n[] el0t_64_sync+0x1a4/0x1a8\\n[] --[ end trace 9c4601d68c70030e ]---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.94\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.34\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.3\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:21:26.013Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-38109\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:22.282Z\", \"dateReserved\": \"2025-04-16T04:51:23.985Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-07-03T08:35:19.240Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…