Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (devlink) that could lead to system instability or crashes. The issue occurs when the system fails to properly clear internal references during the removal of network device rate objects, potentially leading to memory errors. This could be exploited by a local user to cause a denial-of-service (system crash).
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's devlink subsystem within the devl_rate_nodes_destroy function. The root cause is that the function decrements a parent object's reference count but fails to set the devlink_rate->parent pointer to NULL, leaving a dangling pointer. This inconsistency leads to refcount errors and potential memory corruption or system crashes when drivers like netdevsim or mlx5 attempt to destroy rate objects. An attacker with local access could trigger this condition by manipulating devlink port function rates. The issue has been resolved by explicitly unsetting the parent pointer after notifying the driver.
Affected products
- Linux Linux kernel 5.14 to 6.1.164, 6.2 to 6.6.118, 6.7 to 6.12.60, 6.13 to 6.17.10, 6.18-rc1 to 6.18-rc6
Timeline
- 2025-11-17: other: Patch authored
- 2025-12-04: advisory: CVE published
References
- https://git.kernel.org/stable/c/542f45486f1ce2d2dde75bd85aca0389ef7046c3
- https://git.kernel.org/stable/c/715d9cda646a8a38ea8b2bb5afb679a7464055e2
- https://git.kernel.org/stable/c/90e51e20bcec9bff5b2421ce1bd95704764655f5
- https://git.kernel.org/stable/c/c70df6c17d389cc743f0eb30160e2d6bc6910db8
- https://git.kernel.org/stable/c/f94c1a114ac209977bdf5ca841b98424295ab1f0
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html