Executive brief
A vulnerability in the Linux kernel's mlx5 Ethernet driver can cause a use-after-free memory error when traffic control rules are configured in certain network operating modes. This could allow a local attacker to crash the system or potentially execute code, disrupting network connectivity and requiring a system restart.
Technical details
The vulnerability is a use-after-free (CWE-416) in the mlx5e traffic control (TC) code path. The root cause is that the code attempts to access the eswitch (embedded switch) object mapping pool while in NIC mode, where that pool is not initialized. An attacker with local access can trigger this through tc (traffic control) filter configuration operations, causing a KASAN (KernelAddressSanitizer) slab-use-after-free condition in mlx5_add_flow_rules(). The attack vector is local and requires capability to execute tc commands. The fix conditionally uses either the NIC or eswitch object mapping pool depending on whether eswitch mode is enabled.
Affected products
- Linux Linux kernel 6.3.0-rc6 and likely other versions
Timeline
- 2025-12-30: disclosed