CVE-2025-21751 (GCVE-0-2025-21751)
Vulnerability from cvelistv5
Published
2025-02-27 02:12
Modified
2026-08-05 11:54
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow of the function reconnects the matcher back and returns an error, which continues running the calling function and eventually frees the matcher that is being disconnected. This leads to a case where we have a freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case with any other error handling during resource destruction. However, the goal here is to allow the driver to continue and not crash the machine with use-after-free error.
References
Impacted products
Vendor Product Version
Linux Linux Version: 472dd792348f6601ccaa97d5626ee4faff891901
Version: 472dd792348f6601ccaa97d5626ee4faff891901
Version: 472dd792348f6601ccaa97d5626ee4faff891901
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:14:26.697302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:29.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5682aad0276ff9b9b0eff3188eb6a1f504d6b436",
              "status": "affected",
              "version": "472dd792348f6601ccaa97d5626ee4faff891901",
              "versionType": "git"
            },
            {
              "lessThan": "23a86c76a1a197e8fbbbd0ce3e826eb58c471624",
              "status": "affected",
              "version": "472dd792348f6601ccaa97d5626ee4faff891901",
              "versionType": "git"
            },
            {
              "lessThan": "1ce840c7a659aa53a31ef49f0271b4fd0dc10296",
              "status": "affected",
              "version": "472dd792348f6601ccaa97d5626ee4faff891901",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we\u0027re dealing here with FW error. We can\u0027t overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations \u2014 BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink \u2014 not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\nUI:N - No victim action is needed; the freed matcher is left on `tbl-\u003ematchers_list` and is dereferenced by the driver\u0027s own subsequent steering operations with no user involvement.\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace \u2014 a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\nA:H - The commit message states this \"leads to use-after-free and eventual crash\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:07.723Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436"
        },
        {
          "url": "https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296"
        }
      ],
      "title": "net/mlx5: HWS, change error flow on matcher disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21751",
    "datePublished": "2025-02-27T02:12:22.177Z",
    "dateReserved": "2024-12-29T08:45:45.759Z",
    "dateUpdated": "2026-08-05T11:54:07.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21751\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:14:26.697302Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:14:27.891Z\"}}], \"cna\": {\"title\": \"net/mlx5: HWS, change error flow on matcher disconnect\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations \\u2014 BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink \\u2014 not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\\nUI:N - No victim action is needed; the freed matcher is left on `tbl-\u003ematchers_list` and is dereferenced by the driver\u0027s own subsequent steering operations with no user involvement.\\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace \\u2014 a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\\nA:H - The commit message states this \\\"leads to use-after-free and eventual crash\\\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"472dd792348f6601ccaa97d5626ee4faff891901\", \"lessThan\": \"5682aad0276ff9b9b0eff3188eb6a1f504d6b436\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"472dd792348f6601ccaa97d5626ee4faff891901\", \"lessThan\": \"23a86c76a1a197e8fbbbd0ce3e826eb58c471624\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"472dd792348f6601ccaa97d5626ee4faff891901\", \"lessThan\": \"1ce840c7a659aa53a31ef49f0271b4fd0dc10296\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436\"}, {\"url\": \"https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624\"}, {\"url\": \"https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: HWS, change error flow on matcher disconnect\\n\\nCurrently, when firmware failure occurs during matcher disconnect flow,\\nthe error flow of the function reconnects the matcher back and returns\\nan error, which continues running the calling function and eventually\\nfrees the matcher that is being disconnected.\\nThis leads to a case where we have a freed matcher on the matchers list,\\nwhich in turn leads to use-after-free and eventual crash.\\n\\nThis patch fixes that by not trying to reconnect the matcher back when\\nsome FW command fails during disconnect.\\n\\nNote that we\u0027re dealing here with FW error. We can\u0027t overcome this\\nproblem. This might lead to bad steering state (e.g. wrong connection\\nbetween matchers), and will also lead to resource leakage, as it is\\nthe case with any other error handling during resource destruction.\\n\\nHowever, the goal here is to allow the driver to continue and not crash\\nthe machine with use-after-free error.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.48\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.3\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:54:07.723Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21751\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:54:07.723Z\", \"dateReserved\": \"2024-12-29T08:45:45.759Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:12:22.177Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.