CVE-2025-39979 (GCVE-0-2025-39979)

Vulnerability from cvelistv5 – Published: 2025-10-15 07:55 – Updated: 2026-10-15 22:02
VLAI
Title
net/mlx5: fs, fix UAF in flow counter release
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not initialized and the counter struct could already be freed when deleting the rule. Fix it by adding the missing initializations and adding refcount for the local flow counter struct. [1] Kernel log: Call Trace: <TASK> dump_stack_lvl+0x34/0x48 mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core] mlx5_fc_put_hws_action+0x96/0xad [mlx5_core] mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core] mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core] del_hw_fte+0x1ce/0x260 [mlx5_core] mlx5_del_flow_rules+0x12d/0x240 [mlx5_core] ? ttwu_queue_wakelist+0xf4/0x110 mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib] uverbs_free_flow+0x20/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs] uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs] uobj_destroy+0x3c/0x80 [ib_uverbs] ib_uverbs_run_method+0x23e/0x360 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs] ? do_tty_write+0x1a9/0x270 ? file_tty_write.constprop.0+0x98/0xc0 ? new_sync_write+0xfc/0x190 ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs] __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x59/0x90
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:55 UTC
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7061 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b581f4266928d3b5d1bbe711e39623d9a1696091 , < 3c77f6d244188c3fb11f6aec40bbfe884f1803b5 (git)
Affected: b581f4266928d3b5d1bbe711e39623d9a1696091 , < 6043819e707cefb1c9e59d6e431dcfa735c4f975 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.16.10 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:55:44.171884Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:02:35.358Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
            "include/linux/mlx5/fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5",
              "status": "affected",
              "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
              "versionType": "git"
            },
            {
              "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975",
              "status": "affected",
              "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
            "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
            "include/linux/mlx5/fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n  del_hw_fte+0x1ce/0x260 [mlx5_core]\n  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n  ? ttwu_queue_wakelist+0xf4/0x110\n  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n  uverbs_free_flow+0x20/0x50 [ib_uverbs]\n  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n  uobj_destroy+0x3c/0x80 [ib_uverbs]\n  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n  ? do_tty_write+0x1a9/0x270\n  ? file_tty_write.constprop.0+0x98/0xc0\n  ? new_sync_write+0xfc/0x190\n  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n  __x64_sys_ioctl+0x87/0xc0\n  do_syscall_64+0x59/0x90"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only route to the vulnerable code is the `MLX5_IB_METHOD_CREATE_FLOW`/destroy-flow uverbs ioctl on the local `/dev/infiniband/uverbsN` character device (created world-accessible at mode 0666), as shown by the `__x64_sys_ioctl` \u2192 `ib_uverbs_ioctl` \u2192 `mlx5_ib_destroy_flow` call trace. No remote packet or peer data reaches this path.\nAC:L - This is not a race \u2014 `mlx5_del_flow_rules()` frees the local counter in `del_sw_hw_rule()` and then unconditionally reuses it in `del_hw_fte()` \u2192 `mlx5_cmd_hws_delete_fte()` within the same call, so every teardown of a DEVX-counter flow rule deterministically triggers the UAF, and the attacker fully controls both the create and destroy ioctls plus any heap-spray thread.\nPR:L - The attacker needs only the partial CAP_NET_RAW capability, not real root/admin \u2014 it is granted by default to Docker/OCI containers in the initial user namespace, is routinely handed to DPDK/RDMA and HPC workloads, and the uverbs device node itself is world-readable/writable at 0666. This is a limited privilege on the vulnerable component, not full administrative control.\nUI:N - The attacker performs the entire sequence (create DEVX flow counter, create raw flow rule, destroy the flow uobject) from its own process with ordinary ioctls. No victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory and is exploited to gain kernel privileges within the same security authority as the attacking process. No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `mlx5_fs_put_hws_action()` reads `counter-\u003ebulk` and then `fs_hws_data-\u003ehws_action` out of freed slab memory; once the object is reclaimed by a sprayed allocation the attacker controls those reads and the subsequent `action-\u003etype`/`action-\u003ectx` dereferences in `mlx5hws_action_destroy()`, yielding an arbitrary-pointer read primitive and full kernel memory disclosure.\nI:H - The freed object is written after free \u2014 an atomic RMW via `refcount_dec_not_one()`, a `mutex_lock()`, and `fs_hws_data-\u003ehws_action = NULL` \u2014 corrupting whatever structure now occupies the slot, and `mlx5hws_action_destroy()` performs a `kfree()` on a pointer read from attacker-controlled freed memory, an arbitrary-free primitive that is a well-established route to control-flow hijack and privilege escalation.\nA:H - Even without exploitation the bug reliably produces a refcount_t saturation splat, slab corruption, and kernel oops/panic on every flow-rule teardown, and the uninitialized `hws_data.lock` mutex (zeroed `wait_list` with NULL next/prev) causes a NULL dereference or list corruption on any contended `mutex_lock()`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:48.313Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"
        }
      ],
      "title": "net/mlx5: fs, fix UAF in flow counter release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39979",
    "datePublished": "2025-10-15T07:55:59.609Z",
    "dateReserved": "2025-04-16T07:20:57.150Z",
    "dateUpdated": "2026-10-15T22:02:35.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39979",
      "date": "2026-10-24",
      "epss": "0.00144",
      "percentile": "0.03361"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
                  "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
                  "include/linux/mlx5/fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5",
                    "status": "affected",
                    "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975",
                    "status": "affected",
                    "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
                  "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
                  "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
                  "include/linux/mlx5/fs.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n  del_hw_fte+0x1ce/0x260 [mlx5_core]\n  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n  ? ttwu_queue_wakelist+0xf4/0x110\n  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n  uverbs_free_flow+0x20/0x50 [ib_uverbs]\n  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n  uobj_destroy+0x3c/0x80 [ib_uverbs]\n  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n  ? do_tty_write+0x1a9/0x270\n  ? file_tty_write.constprop.0+0x98/0xc0\n  ? new_sync_write+0xfc/0x190\n  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n  __x64_sys_ioctl+0x87/0xc0\n  do_syscall_64+0x59/0x90"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5: fs, soluciona UAF en la liberaci\u00f3n del contador de flujo\n\nSoluciona un rastreo del kernel [1] causado por la liberaci\u00f3n de una acci\u00f3n HWS de un contador de flujo local en mlx5_cmd_hws_delete_fte(), donde el recuento de referencias (refcount) y el mutex de la acci\u00f3n HWS no estaban inicializados y la estructura del contador ya podr\u00eda haber sido liberada al eliminar la regla.\n\nSe soluciona a\u00f1adiendo las inicializaciones faltantes y a\u00f1adiendo el recuento de referencias (refcount) para la estructura del contador de flujo local.\n\n[1] Registro del kernel:\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n  del_hw_fte+0x1ce/0x260 [mlx5_core]\n  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n  ? ttwu_queue_wakelist+0xf4/0x110\n  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n  uverbs_free_flow+0x20/0x50 [ib_uverbs]\n  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n  uobj_destroy+0x3c/0x80 [ib_uverbs]\n  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n  ? do_tty_write+0x1a9/0x270\n  ? file_tty_write.constprop.0+0x98/0xc0\n  ? new_sync_write+0xfc/0x190\n  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n  __x64_sys_ioctl+0x87/0xc0\n  do_syscall_64+0x59/0x90"
          }
        ],
        "id": "CVE-2025-39979",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-39979",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:55:44.171884Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-15T08:15:35.767",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:54:04+00:00",
      "cve": "CVE-2025-39979",
      "id": "CVE-2025-39979",
      "initial_release_date": "2025-10-15T00:00:00+00:00",
      "product_status:fixed": "612",
      "product_status:known_affected": "36",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: fs, fix UAF in flow counter release",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39979.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-39979",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:55:44.171884Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:55:44.787Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
                "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
                "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
                "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
                "include/linux/mlx5/fs.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5",
                  "status": "affected",
                  "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
                  "versionType": "git"
                },
                {
                  "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975",
                  "status": "affected",
                  "version": "b581f4266928d3b5d1bbe711e39623d9a1696091",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c",
                "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h",
                "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c",
                "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c",
                "include/linux/mlx5/fs.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.14"
                },
                {
                  "lessThan": "6.14",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.16.*",
                  "status": "unaffected",
                  "version": "6.16.10",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.16.10",
                      "versionStartIncluding": "6.14",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17",
                      "versionStartIncluding": "6.14",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n  del_hw_fte+0x1ce/0x260 [mlx5_core]\n  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n  ? ttwu_queue_wakelist+0xf4/0x110\n  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n  uverbs_free_flow+0x20/0x50 [ib_uverbs]\n  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n  uobj_destroy+0x3c/0x80 [ib_uverbs]\n  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n  ? do_tty_write+0x1a9/0x270\n  ? file_tty_write.constprop.0+0x98/0xc0\n  ? new_sync_write+0xfc/0x190\n  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n  __x64_sys_ioctl+0x87/0xc0\n  do_syscall_64+0x59/0x90"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The only route to the vulnerable code is the `MLX5_IB_METHOD_CREATE_FLOW`/destroy-flow uverbs ioctl on the local `/dev/infiniband/uverbsN` character device (created world-accessible at mode 0666), as shown by the `__x64_sys_ioctl` \u2192 `ib_uverbs_ioctl` \u2192 `mlx5_ib_destroy_flow` call trace. No remote packet or peer data reaches this path.\nAC:L - This is not a race \u2014 `mlx5_del_flow_rules()` frees the local counter in `del_sw_hw_rule()` and then unconditionally reuses it in `del_hw_fte()` \u2192 `mlx5_cmd_hws_delete_fte()` within the same call, so every teardown of a DEVX-counter flow rule deterministically triggers the UAF, and the attacker fully controls both the create and destroy ioctls plus any heap-spray thread.\nPR:L - The attacker needs only the partial CAP_NET_RAW capability, not real root/admin \u2014 it is granted by default to Docker/OCI containers in the initial user namespace, is routinely handed to DPDK/RDMA and HPC workloads, and the uverbs device node itself is world-readable/writable at 0666. This is a limited privilege on the vulnerable component, not full administrative control.\nUI:N - The attacker performs the entire sequence (create DEVX flow counter, create raw flow rule, destroy the flow uobject) from its own process with ordinary ioctls. No victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory and is exploited to gain kernel privileges within the same security authority as the attacking process. No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `mlx5_fs_put_hws_action()` reads `counter-\u003ebulk` and then `fs_hws_data-\u003ehws_action` out of freed slab memory; once the object is reclaimed by a sprayed allocation the attacker controls those reads and the subsequent `action-\u003etype`/`action-\u003ectx` dereferences in `mlx5hws_action_destroy()`, yielding an arbitrary-pointer read primitive and full kernel memory disclosure.\nI:H - The freed object is written after free \u2014 an atomic RMW via `refcount_dec_not_one()`, a `mutex_lock()`, and `fs_hws_data-\u003ehws_action = NULL` \u2014 corrupting whatever structure now occupies the slot, and `mlx5hws_action_destroy()` performs a `kfree()` on a pointer read from attacker-controlled freed memory, an arbitrary-free primitive that is a well-established route to control-flow hijack and privilege escalation.\nA:H - Even without exploitation the bug reliably produces a refcount_t saturation splat, slab corruption, and kernel oops/panic on every flow-rule teardown, and the uninitialized `hws_data.lock` mutex (zeroed `wait_list` with NULL next/prev) causes a NULL dereference or list corruption on any contended `mutex_lock()`."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:06:48.313Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"
            },
            {
              "url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"
            }
          ],
          "title": "net/mlx5: fs, fix UAF in flow counter release",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-39979",
        "datePublished": "2025-10-15T07:55:59.609Z",
        "dateReserved": "2025-04-16T07:20:57.150Z",
        "dateUpdated": "2026-10-15T22:02:35.358Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.