CVE-2025-40251
BaseFortify
Publication date: 2025-12-04
Last updated on: 2026-02-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | 6.18 |
| linux | linux_kernel | From 6.13 (inc) to 6.17.10 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.60 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.118 (exc) |
| linux | linux_kernel | From 5.14 (inc) to 6.1.164 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the devlink rate subsystem where the function devl_rate_nodes_destroy was supposed to unset the parent pointer for all rate objects. However, it failed to actually set the devlink_rate->parent pointer to NULL after decrementing the parent's reference count. This left a dangling pointer in the devlink_rate structure, causing reference count errors and potential memory leaks in components like netdevsim and mlx5 drivers. The issue was fixed by explicitly setting the parent pointer to NULL as intended.
How can this vulnerability impact me? :
This vulnerability can lead to reference count errors and memory leaks in the Linux kernel networking components, specifically in netdevsim and mlx5 drivers. Such memory management issues could cause instability or crashes in systems using these components, potentially affecting network device functionality and reliability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the error conditions that cause refcount warnings in the kernel logs (dmesg). For netdevsim devices, you can run the following commands to trigger the issue and check dmesg for refcount warnings: 1. echo 1 > /sys/bus/netdevsim/new_device 2. devlink dev eswitch set netdevsim/netdevsim1 mode switchdev 3. echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs 4. devlink port function rate add netdevsim/netdevsim1/test_node 5. devlink port function rate set netdevsim/netdevsim1/128 parent test_node 6. echo 1 > /sys/bus/netdevsim/del_device For mlx5 devices, use: 1. devlink dev eswitch set pci/0000:08:00.0 mode switchdev 2. devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 3. devlink port function rate add pci/0000:08:00.0/group1 4. devlink port function rate set pci/0000:08:00.0/32768 parent group1 5. modprobe -r mlx5_ib mlx5_fwctl mlx5_core Then check dmesg for warnings like "refcount_t: decrement hit 0; leaking memory." which indicate the presence of the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the patch that explicitly sets the devlink_rate->parent pointer to NULL after notifying the driver, as this fixes the dangling pointer issue. Until the patch is applied, avoid operations that trigger devl_rate_nodes_destroy on affected devices (netdevsim and mlx5) such as adding/removing rate nodes or unloading related kernel modules. Monitoring dmesg for refcount warnings can help identify if the issue is occurring. Updating the Linux kernel to a version that includes this fix is the recommended long-term mitigation.