{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39979", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.150Z", "datePublished": "2025-10-15T07:55:59.609Z", "dateUpdated": "2026-08-05T12:06:48.313Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:48.313Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n \n dump_stack_lvl+0x34/0x48\n mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n del_hw_fte+0x1ce/0x260 [mlx5_core]\n mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n ? ttwu_queue_wakelist+0xf4/0x110\n mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n uverbs_free_flow+0x20/0x50 [ib_uverbs]\n destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n uobj_destroy+0x3c/0x80 [ib_uverbs]\n ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n ? do_tty_write+0x1a9/0x270\n ? file_tty_write.constprop.0+0x98/0xc0\n ? new_sync_write+0xfc/0x190\n ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n __x64_sys_ioctl+0x87/0xc0\n do_syscall_64+0x59/0x90" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The only route to the vulnerable code is the `MLX5_IB_METHOD_CREATE_FLOW`/destroy-flow uverbs ioctl on the local `/dev/infiniband/uverbsN` character device (created world-accessible at mode 0666), as shown by the `__x64_sys_ioctl` → `ib_uverbs_ioctl` → `mlx5_ib_destroy_flow` call trace. No remote packet or peer data reaches this path.\nAC:L - This is not a race — `mlx5_del_flow_rules()` frees the local counter in `del_sw_hw_rule()` and then unconditionally reuses it in `del_hw_fte()` → `mlx5_cmd_hws_delete_fte()` within the same call, so every teardown of a DEVX-counter flow rule deterministically triggers the UAF, and the attacker fully controls both the create and destroy ioctls plus any heap-spray thread.\nPR:L - The attacker needs only the partial CAP_NET_RAW capability, not real root/admin — it is granted by default to Docker/OCI containers in the initial user namespace, is routinely handed to DPDK/RDMA and HPC workloads, and the uverbs device node itself is world-readable/writable at 0666. This is a limited privilege on the vulnerable component, not full administrative control.\nUI:N - The attacker performs the entire sequence (create DEVX flow counter, create raw flow rule, destroy the flow uobject) from its own process with ordinary ioctls. No victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory and is exploited to gain kernel privileges within the same security authority as the attacking process. No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `mlx5_fs_put_hws_action()` reads `counter->bulk` and then `fs_hws_data->hws_action` out of freed slab memory; once the object is reclaimed by a sprayed allocation the attacker controls those reads and the subsequent `action->type`/`action->ctx` dereferences in `mlx5hws_action_destroy()`, yielding an arbitrary-pointer read primitive and full kernel memory disclosure.\nI:H - The freed object is written after free — an atomic RMW via `refcount_dec_not_one()`, a `mutex_lock()`, and `fs_hws_data->hws_action = NULL` — corrupting whatever structure now occupies the slot, and `mlx5hws_action_destroy()` performs a `kfree()` on a pointer read from attacker-controlled freed memory, an arbitrary-free primitive that is a well-established route to control-flow hijack and privilege escalation.\nA:H - Even without exploitation the bug reliably produces a refcount_t saturation splat, slab corruption, and kernel oops/panic on every flow-rule teardown, and the uninitialized `hws_data.lock` mutex (zeroed `wait_list` with NULL next/prev) causes a NULL dereference or list corruption on any contended `mutex_lock()`." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h" ], "versions": [ { "version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5", "status": "affected", "versionType": "git" }, { "version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h" ], "versions": [ { "version": "6.14", "status": "affected" }, { "version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.10", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.16.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5" }, { "url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975" } ], "title": "net/mlx5: fs, fix UAF in flow counter release", "x_generator": { "engine": "bippy-1.2.0" } } } }