Executive brief
A vulnerability was identified in the Linux kernel's Mellanox (mlx5) network driver that could lead to system instability or crashes. The issue occurs when the driver incorrectly handles network data packets that have been modified by high-performance packet processing programs (XDP). This could potentially allow a remote attacker to trigger a kernel panic or execute unauthorized actions by sending specially crafted network traffic, impacting the availability and security of the affected system.
Technical details
The vulnerability exists in the mlx5e driver's RX path, specifically within the `mlx5e_skb_from_cqe_mpwrq_nonlinear` function when handling multi-buffer XDP. The driver incorrectly assumed that the layout of an `xdp_buff` remained unchanged after XDP program execution. If an XDP program uses `bpf_xdp_adjust_head()` to add linear data or `bpf_xdp_adjust_tail()` to shrink non-linear data, the driver might ignore the new linear data or pass an invalid delta to `__pskb_pull_tail()`, triggering a `BUG_ON`. This can result in a kernel panic (DoS). The fix involves recalculating the number of fragments and truesize based on the modified `xdp_buff` before building the socket buffer (skb). Patch availability is confirmed in stable kernel branches 6.6.y, 6.12.y, and 6.17.y.
Affected products
- Linux Linux Kernel 6.4 to 6.6.115, 6.12.56, 6.17.6
Timeline
- 2025-10-16: patched: Initial fix authored by Amery Hung
- 2025-12-16: disclosed: CVE-2025-40350 published