CVE-2025-38590 (GCVE-0-2025-38590)
Vulnerability from cvelistv5
Published
2025-08-19 17:03
Modified
2026-08-05 12:03
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup. Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0. Subsequently, functions like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer. This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath. BUG: unable to handle page fault for address: ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__xfrm_policy_check+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ? udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410 __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530 udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130 ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130 ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210 mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170 net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0 handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0 </IRQ>
References
Impacted products
Vendor Product Version
Linux Linux Version: b2ac7541e3777f325c49d900550c9e3dd10c0eda
Version: b2ac7541e3777f325c49d900550c9e3dd10c0eda
Version: b2ac7541e3777f325c49d900550c9e3dd10c0eda
Version: b2ac7541e3777f325c49d900550c9e3dd10c0eda
Version: b2ac7541e3777f325c49d900550c9e3dd10c0eda
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "314f568b84b01f6eac1e4313ca47f9ade4349443",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "781a0bbf377443ef06f3248221f06cb555935530",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "3a5782431d84716b66302b07ff1b32fea1023bd5",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "137b12a4900eb6971b889839eab6036f72cbb217",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            },
            {
              "lessThan": "6d19c44b5c6dd72f9a357d0399604ec16a77de3c",
              "status": "affected",
              "version": "b2ac7541e3777f325c49d900550c9e3dd10c0eda",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Remove skb secpath if xfrm state is not found\n\nHardware returns a unique identifier for a decrypted packet\u0027s xfrm\nstate, this state is looked up in an xarray. However, the state might\nhave been freed by the time of this lookup.\n\nCurrently, if the state is not found, only a counter is incremented.\nThe secpath (sp) extension on the skb is not removed, resulting in\nsp-\u003elen becoming 0.\n\nSubsequently, functions like __xfrm_policy_check() attempt to access\nfields such as xfrm_input_state(skb)-\u003exso.type (which dereferences\nsp-\u003exvec[sp-\u003elen - 1]) without first validating sp-\u003elen. This leads to\na crash when dereferencing an invalid state pointer.\n\nThis patch prevents the crash by explicitly removing the secpath\nextension from the skb if the xfrm state is not found after hardware\ndecryption. This ensures downstream functions do not operate on a\nzero-length secpath.\n\n BUG: unable to handle page fault for address: ffffffff000002c8\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 282e067 P4D 282e067 PUD 0\n Oops: Oops: 0000 [#1] SMP\n CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:__xfrm_policy_check+0x61a/0xa30\n Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 \u003c0f\u003e b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa\n RSP: 0018:ffff88885fb04918 EFLAGS: 00010297\n RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000\n RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000\n RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353\n R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8\n R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00\n FS:  0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n  \u003cIRQ\u003e\n  ? try_to_wake_up+0x108/0x4c0\n  ? udp4_lib_lookup2+0xbe/0x150\n  ? udp_lib_lport_inuse+0x100/0x100\n  ? __udp4_lib_lookup+0x2b0/0x410\n  __xfrm_policy_check2.constprop.0+0x11e/0x130\n  udp_queue_rcv_one_skb+0x1d/0x530\n  udp_unicast_rcv_skb+0x76/0x90\n  __udp4_lib_rcv+0xa64/0xe90\n  ip_protocol_deliver_rcu+0x20/0x130\n  ip_local_deliver_finish+0x75/0xa0\n  ip_local_deliver+0xc1/0xd0\n  ? ip_protocol_deliver_rcu+0x130/0x130\n  ip_sublist_rcv+0x1f9/0x240\n  ? ip_rcv_finish_core+0x430/0x430\n  ip_list_rcv+0xfc/0x130\n  __netif_receive_skb_list_core+0x181/0x1e0\n  netif_receive_skb_list_internal+0x200/0x360\n  ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core]\n  gro_receive_skb+0xfd/0x210\n  mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core]\n  mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core]\n  ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core]\n  mlx5e_napi_poll+0x114/0xab0 [mlx5_core]\n  __napi_poll+0x25/0x170\n  net_rx_action+0x32d/0x3a0\n  ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core]\n  ? notifier_call_chain+0x33/0xa0\n  handle_softirqs+0xda/0x250\n  irq_exit_rcu+0x6d/0xc0\n  common_interrupt+0x81/0xa0\n  \u003c/IRQ\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is triggered purely by receiving network packets \u2014 ESP traffic decrypted by the mlx5 NIC\u0027s IPsec offload engine and processed in `mlx5e_build_rx_skb()`/NAPI. No local access to the target is needed; a remote peer on the IPsec tunnel drives the entire condition.\nAC:L - The attacker controls both sides of the race: it can force the SA teardown (IKE rekey or CREATE_CHILD_SA/DELETE, or driving hard lifetime expiry) while flooding ESP packets on the old SA, and the window between `xdo_dev_state_delete` (xarray erase) and `xdo_dev_state_free` (HW rule removal, deferred through refcount drop and the state GC workqueue) spans milliseconds during which every packet on that SA deterministically hits the miss path.\nPR:N - The attacker needs no account, capability, or any privilege on the target host \u2014 it acts purely as a remote network peer sending traffic and IKE control messages. This matches the scoring of the directly analogous mlx5e IPsec RX-path race (CVE-2026-23440, PR:N).\nUI:N - No victim action is required; the crash occurs autonomously in softirq context while processing received packets during routine SA teardown/rekey.\nS:U - The out-of-bounds read and the resulting fault are entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The `sp-\u003exvec[-1]` access is a bounded 8-byte read of the skb_ext header padding within the same allocation, and the subsequent 1-byte wild dereference only feeds a boolean that has no effect (`secpath_has_nontransport()` over a zero-length secpath returns 0 either way); no data is ever returned to or observable by the attacker.\nI:N - There is no write primitive \u2014 the bug is a read of an uninitialized pointer followed by a load. With `sp-\u003elen == 0` the policy check fails closed (empty secpath fails template matching), so no packet is wrongly accepted through the xfrm policy engine.\nA:H - Dereferencing the garbage pointer faults on an unmapped address inside NAPI/softirq context (`Comm: swapper/N`, `\u003cIRQ\u003e`), producing a fatal exception in interrupt and a full kernel panic, repeatable on every SA teardown under traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:12.608Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/314f568b84b01f6eac1e4313ca47f9ade4349443"
        },
        {
          "url": "https://git.kernel.org/stable/c/781a0bbf377443ef06f3248221f06cb555935530"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a5782431d84716b66302b07ff1b32fea1023bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/137b12a4900eb6971b889839eab6036f72cbb217"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d19c44b5c6dd72f9a357d0399604ec16a77de3c"
        }
      ],
      "title": "net/mlx5e: Remove skb secpath if xfrm state is not found",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38590",
    "datePublished": "2025-08-19T17:03:11.691Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-08-05T12:03:12.608Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.