Executive brief
A vulnerability in the Linux kernel's Mellanox network driver could allow a remote attacker to crash the system. The issue occurs when the hardware processes encrypted network traffic but cannot find the necessary security information for a specific packet. This leads to a system failure (kernel crash) which impacts the availability of the server and any services running on it.
Technical details
A vulnerability exists in the net/mlx5e driver within the Linux kernel's IPsec Rx data path offload. When hardware returns a unique identifier for a decrypted packet's XFRM state, the driver performs a lookup in an xarray. If the state has been freed and the lookup fails, the driver fails to remove the secpath (sp) extension from the socket buffer (skb), leaving sp->len at 0. Downstream functions, specifically __xfrm_policy_check(), subsequently attempt to dereference sp->xvec[sp->len - 1] without validation, resulting in a supervisor read access page fault and kernel oops. The fix involves explicitly calling secpath_reset(skb) when the XFRM state lookup fails.
Affected products
- Linux Linux Kernel b2ac7541e377 to 6d19c44b5c6d
Timeline
- 2025-07-23: patched: Initial patch authored by Jianbo Liu
- 2025-08-19: advisory: CVE-2025-38590 published
References
- https://git.kernel.org/stable/c/137b12a4900eb6971b889839eab6036f72cbb217
- https://git.kernel.org/stable/c/314f568b84b01f6eac1e4313ca47f9ade4349443
- https://git.kernel.org/stable/c/3a5782431d84716b66302b07ff1b32fea1023bd5
- https://git.kernel.org/stable/c/6d19c44b5c6dd72f9a357d0399604ec16a77de3c
- https://git.kernel.org/stable/c/781a0bbf377443ef06f3248221f06cb555935530