Executive brief
The Linux kernel's mlx5 Ethernet driver contains a use-after-free vulnerability in its handling of flow post action attributes. During flow configuration updates, the driver incorrectly clones attributes twice instead of reusing them, causing freed memory to be accessed later. This can lead to kernel crashes and potential privilege escalation on systems using affected Mellanox/NVIDIA network interface cards.
Technical details
The vulnerability exists in mlx5e_tc_post_act_add() where flow attributes are cloned a second time despite already being cloned in mlx5e_clone_flow_attr_for_post_act(). This double-cloning causes the second copy to become stale when neighbor updates occur, leading to use-after-free when the freed attribute is dereferenced in mlx5_cmd_set_fte(). The flaw affects flow table entry creation in the mlx5 core driver's traffic control path. An attacker with the ability to trigger network flow reconfiguration (e.g., via container networking, tc flower rules, or neighbor table updates) can exploit this to crash the kernel or achieve privilege escalation. The fix involves removing the redundant cloning and directly assigning the pre-cloned attribute handle instead.
Affected products
- Linux Linux kernel 5.x through 6.x (mlx5 driver)
Timeline
- 2025-12-30: disclosed