Executive brief
A vulnerability in the Linux kernel's Mellanox network driver could allow malformed firmware to crash the system or access unauthorized memory. The issue exists in the firmware tracer component, which processes diagnostic messages from the network hardware. If the hardware provides a specially crafted message, it can trigger a system failure or lead to unpredictable behavior.
Technical details
A format string vulnerability exists in the mlx5 firmware tracer (fw_tracer.c) within the Linux kernel. The component receives format strings directly from device firmware and uses them in snprintf() calls without sufficient validation of format specifiers. An attacker capable of providing or spoofing malicious firmware could use invalid specifiers (such as %s, %p, or %n) to trigger a kernel crash (DoS) or potentially read/write arbitrary memory. The fix introduces mlx5_tracer_validate_params() to ensure only safe integer and hex format specifiers are processed.
Affected products
- Linux Linux Kernel 70dd6fdb8987 to 95624b731c49
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-12-09: other: Patch authored by Shay Drory
- 2026-01-13: disclosed: CVE published
References
- https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d
- https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7
- https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3
- https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a
- https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0
- https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0
- https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749