{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38590",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:24.026Z",
        "datePublished": "2025-08-19T17:03:11.691Z",
        "dateUpdated": "2026-08-05T12:03:12.608Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:03:12.608Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Remove skb secpath if xfrm state is not found\n\nHardware returns a unique identifier for a decrypted packet's xfrm\nstate, this state is looked up in an xarray. However, the state might\nhave been freed by the time of this lookup.\n\nCurrently, if the state is not found, only a counter is incremented.\nThe secpath (sp) extension on the skb is not removed, resulting in\nsp->len becoming 0.\n\nSubsequently, functions like __xfrm_policy_check() attempt to access\nfields such as xfrm_input_state(skb)->xso.type (which dereferences\nsp->xvec[sp->len - 1]) without first validating sp->len. This leads to\na crash when dereferencing an invalid state pointer.\n\nThis patch prevents the crash by explicitly removing the secpath\nextension from the skb if the xfrm state is not found after hardware\ndecryption. This ensures downstream functions do not operate on a\nzero-length secpath.\n\n BUG: unable to handle page fault for address: ffffffff000002c8\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 282e067 P4D 282e067 PUD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__xfrm_policy_check+0x61a/0xa30\n Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa\n RSP: 0018:ffff88885fb04918 EFLAGS: 00010297\n RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000\n RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000\n RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353\n R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8\n R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00\n FS:  0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  <IRQ>\n  ? try_to_wake_up+0x108/0x4c0\n  ? udp4_lib_lookup2+0xbe/0x150\n  ? udp_lib_lport_inuse+0x100/0x100\n  ? __udp4_lib_lookup+0x2b0/0x410\n  __xfrm_policy_check2.constprop.0+0x11e/0x130\n  udp_queue_rcv_one_skb+0x1d/0x530\n  udp_unicast_rcv_skb+0x76/0x90\n  __udp4_lib_rcv+0xa64/0xe90\n  ip_protocol_deliver_rcu+0x20/0x130\n  ip_local_deliver_finish+0x75/0xa0\n  ip_local_deliver+0xc1/0xd0\n  ? ip_protocol_deliver_rcu+0x130/0x130\n  ip_sublist_rcv+0x1f9/0x240\n  ? ip_rcv_finish_core+0x430/0x430\n  ip_list_rcv+0xfc/0x130\n  __netif_receive_skb_list_core+0x181/0x1e0\n  netif_receive_skb_list_internal+0x200/0x360\n  ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core]\n  gro_receive_skb+0xfd/0x210\n  mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core]\n  mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core]\n  ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core]\n  mlx5e_napi_poll+0x114/0xab0 [mlx5_core]\n  __napi_poll+0x25/0x170\n  net_rx_action+0x32d/0x3a0\n  ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core]\n  ? notifier_call_chain+0x33/0xa0\n  handle_softirqs+0xda/0x250\n  irq_exit_rcu+0x6d/0xc0\n  common_interrupt+0x81/0xa0\n  </IRQ>"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                        "baseScore": 7.5,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:N - The vulnerability is triggered purely by receiving network packets — ESP traffic decrypted by the mlx5 NIC's IPsec offload engine and processed in `mlx5e_build_rx_skb()`/NAPI. No local access to the target is needed; a remote peer on the IPsec tunnel drives the entire condition.\nAC:L - The attacker controls both sides of the race: it can force the SA teardown (IKE rekey or CREATE_CHILD_SA/DELETE, or driving hard lifetime expiry) while flooding ESP packets on the old SA, and the window between `xdo_dev_state_delete` (xarray erase) and `xdo_dev_state_free` (HW rule removal, deferred through refcount drop and the state GC workqueue) spans milliseconds during which every packet on that SA deterministically hits the miss path.\nPR:N - The attacker needs no account, capability, or any privilege on the target host — it acts purely as a remote network peer sending traffic and IKE control messages. This matches the scoring of the directly analogous mlx5e IPsec RX-path race (CVE-2026-23440, PR:N).\nUI:N - No victim action is required; the crash occurs autonomously in softirq context while processing received packets during routine SA teardown/rekey.\nS:U - The out-of-bounds read and the resulting fault are entirely within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The `sp->xvec[-1]` access is a bounded 8-byte read of the skb_ext header padding within the same allocation, and the subsequent 1-byte wild dereference only feeds a boolean that has no effect (`secpath_has_nontransport()` over a zero-length secpath returns 0 either way); no data is ever returned to or observable by the attacker.\nI:N - There is no write primitive — the bug is a read of an uninitialized pointer followed by a load. With `sp->len == 0` the policy check fails closed (empty secpath fails template matching), so no packet is wrongly accepted through the xfrm policy engine.\nA:H - Dereferencing the garbage pointer faults on an unmapped address inside NAPI/softirq context (`Comm: swapper/N`, `<IRQ>`), producing a fatal exception in interrupt and a full kernel panic, repeatable on every SA teardown under traffic."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
                    ],
                    "versions": [
                        {
                            "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                            "lessThan": "314f568b84b01f6eac1e4313ca47f9ade4349443",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                            "lessThan": "781a0bbf377443ef06f3248221f06cb555935530",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                            "lessThan": "3a5782431d84716b66302b07ff1b32fea1023bd5",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                            "lessThan": "137b12a4900eb6971b889839eab6036f72cbb217",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
                            "lessThan": "6d19c44b5c6dd72f9a357d0399604ec16a77de3c",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
                    ],
                    "versions": [
                        {
                            "version": "5.9",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.9",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.102",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.42",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15.10",
                            "lessThanOrEqual": "6.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.16.1",
                            "lessThanOrEqual": "6.16.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.17",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.9",
                                    "versionEndExcluding": "6.6.102"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.9",
                                    "versionEndExcluding": "6.12.42"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.9",
                                    "versionEndExcluding": "6.15.10"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.9",
                                    "versionEndExcluding": "6.16.1"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.9",
                                    "versionEndExcluding": "6.17"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/314f568b84b01f6eac1e4313ca47f9ade4349443"
                },
                {
                    "url": "https://git.kernel.org/stable/c/781a0bbf377443ef06f3248221f06cb555935530"
                },
                {
                    "url": "https://git.kernel.org/stable/c/3a5782431d84716b66302b07ff1b32fea1023bd5"
                },
                {
                    "url": "https://git.kernel.org/stable/c/137b12a4900eb6971b889839eab6036f72cbb217"
                },
                {
                    "url": "https://git.kernel.org/stable/c/6d19c44b5c6dd72f9a357d0399604ec16a77de3c"
                }
            ],
            "title": "net/mlx5e: Remove skb secpath if xfrm state is not found",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}