{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21751","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-12-29T08:45:45.759Z","datePublished":"2025-02-27T02:12:22.177Z","dateUpdated":"2026-08-05T11:54:07.723Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:54:07.723Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations — BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink — not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\nUI:N - No victim action is needed; the freed matcher is left on `tbl->matchers_list` and is dereferenced by the driver's own subsequent steering operations with no user involvement.\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace — a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\nA:H - The commit message states this \"leads to use-after-free and eventual crash\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"],"versions":[{"version":"472dd792348f6601ccaa97d5626ee4faff891901","lessThan":"5682aad0276ff9b9b0eff3188eb6a1f504d6b436","status":"affected","versionType":"git"},{"version":"472dd792348f6601ccaa97d5626ee4faff891901","lessThan":"23a86c76a1a197e8fbbbd0ce3e826eb58c471624","status":"affected","versionType":"git"},{"version":"472dd792348f6601ccaa97d5626ee4faff891901","lessThan":"1ce840c7a659aa53a31ef49f0271b4fd0dc10296","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"],"versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","status":"unaffected","versionType":"semver"},{"version":"6.12.48","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.3","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.12.48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.13.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12","versionEndExcluding":"6.14"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436"},{"url":"https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624"},{"url":"https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296"}],"title":"net/mlx5: HWS, change error flow on matcher disconnect","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2025-21751","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-27T18:14:26.697302Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-416","description":"CWE-416 Use After Free"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-27T18:22:29.728Z"}}]}}