CVE-2025-21751 (GCVE-0-2025-21751)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-08-05 11:54
VLAI
Title
net/mlx5: HWS, change error flow on matcher disconnect
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow of the function reconnects the matcher back and returns an error, which continues running the calling function and eventually frees the matcher that is being disconnected. This leads to a case where we have a freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case with any other error handling during resource destruction. However, the goal here is to allow the driver to continue and not crash the machine with use-after-free error.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 472dd792348f6601ccaa97d5626ee4faff891901 , < 5682aad0276ff9b9b0eff3188eb6a1f504d6b436 (git)
Affected: 472dd792348f6601ccaa97d5626ee4faff891901 , < 23a86c76a1a197e8fbbbd0ce3e826eb58c471624 (git)
Affected: 472dd792348f6601ccaa97d5626ee4faff891901 , < 1ce840c7a659aa53a31ef49f0271b4fd0dc10296 (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.48 , ≤ 6.12.* (semver)
Unaffected: 6.13.3 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:14:26.697302Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:29.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5682aad0276ff9b9b0eff3188eb6a1f504d6b436",
              "status": "affected",
              "version": "472dd792348f6601ccaa97d5626ee4faff891901",
              "versionType": "git"
            },
            {
              "lessThan": "23a86c76a1a197e8fbbbd0ce3e826eb58c471624",
              "status": "affected",
              "version": "472dd792348f6601ccaa97d5626ee4faff891901",
              "versionType": "git"
            },
            {
              "lessThan": "1ce840c7a659aa53a31ef49f0271b4fd0dc10296",
              "status": "affected",
              "version": "472dd792348f6601ccaa97d5626ee4faff891901",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we\u0027re dealing here with FW error. We can\u0027t overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations \u2014 BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink \u2014 not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\nUI:N - No victim action is needed; the freed matcher is left on `tbl-\u003ematchers_list` and is dereferenced by the driver\u0027s own subsequent steering operations with no user involvement.\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace \u2014 a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\nA:H - The commit message states this \"leads to use-after-free and eventual crash\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:07.723Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436"
        },
        {
          "url": "https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296"
        }
      ],
      "title": "net/mlx5: HWS, change error flow on matcher disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21751",
    "datePublished": "2025-02-27T02:12:22.177Z",
    "dateReserved": "2024-12-29T08:45:45.759Z",
    "dateUpdated": "2026-08-05T11:54:07.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21751",
      "date": "2026-08-06",
      "epss": "0.00221",
      "percentile": "0.12706"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:12:04.000Z",
      "cve": "CVE-2025-21751",
      "id": "msrc_CVE-2025-21751",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:known_not_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/mlx5: HWS, change error flow on matcher disconnect",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21751.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21751\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-27T03:15:15.760\",\"lastModified\":\"2026-06-17T08:44:11.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: HWS, change error flow on matcher disconnect\\n\\nCurrently, when firmware failure occurs during matcher disconnect flow,\\nthe error flow of the function reconnects the matcher back and returns\\nan error, which continues running the calling function and eventually\\nfrees the matcher that is being disconnected.\\nThis leads to a case where we have a freed matcher on the matchers list,\\nwhich in turn leads to use-after-free and eventual crash.\\n\\nThis patch fixes that by not trying to reconnect the matcher back when\\nsome FW command fails during disconnect.\\n\\nNote that we\u0027re dealing here with FW error. We can\u0027t overcome this\\nproblem. This might lead to bad steering state (e.g. wrong connection\\nbetween matchers), and will also lead to resource leakage, as it is\\nthe case with any other error handling during resource destruction.\\n\\nHowever, the goal here is to allow the driver to continue and not crash\\nthe machine with use-after-free error.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: HWS, cambiar el flujo de error en la desconexi\u00f3n del comparador Actualmente, cuando ocurre una falla de firmware durante el flujo de desconexi\u00f3n del comparador, el flujo de error de la funci\u00f3n vuelve a conectar el comparador y devuelve un error, que contin\u00faa ejecutando la funci\u00f3n de llamada y finalmente libera el comparador que se est\u00e1 desconectando. Esto lleva a un caso en el que tenemos un comparador liberado en la lista de comparadores, lo que a su vez lleva a un use after free y un eventual bloqueo. Este parche lo corrige al no intentar volver a conectar el comparador cuando alg\u00fan comando de FW falla durante la desconexi\u00f3n. Tenga en cuenta que aqu\u00ed estamos tratando con un error de FW. No podemos superar este problema. Esto puede llevar a un mal estado de direcci\u00f3n (por ejemplo, conexi\u00f3n incorrecta entre comparadores) y tambi\u00e9n conducir\u00e1 a una fuga de recursos, como es el caso con cualquier otro manejo de errores durante la destrucci\u00f3n de recursos. Sin embargo, el objetivo aqu\u00ed es permitir que el controlador contin\u00fae y no bloquee la m\u00e1quina con un error de use after free.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"472dd792348f6601ccaa97d5626ee4faff891901\",\"lessThan\":\"5682aad0276ff9b9b0eff3188eb6a1f504d6b436\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"472dd792348f6601ccaa97d5626ee4faff891901\",\"lessThan\":\"23a86c76a1a197e8fbbbd0ce3e826eb58c471624\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"472dd792348f6601ccaa97d5626ee4faff891901\",\"lessThan\":\"1ce840c7a659aa53a31ef49f0271b4fd0dc10296\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.48\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.3\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-27T18:14:26.697302Z\",\"id\":\"CVE-2025-21751\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.13.3\",\"matchCriteriaId\":\"BE4E9494-C003-4567-B9CB-CF0C8429C517\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:58:54+00:00",
      "cve": "CVE-2025-21751",
      "id": "CVE-2025-21751",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: HWS, change error flow on matcher disconnect",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21751.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:20:22Z",
      "cve": "CVE-2025-21751",
      "id": "CVE-2025-21751",
      "initial_release_date": "2025-02-28T02:21:25Z",
      "product_status:known_not_affected": "352",
      "product_status:recommended": "112",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21751",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21751.json",
      "version": "21"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21751\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T18:14:26.697302Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T18:14:27.891Z\"}}], \"cna\": {\"title\": \"net/mlx5: HWS, change error flow on matcher disconnect\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable `hws_matcher_disconnect()` is only reached from mlx5 control-plane operations \\u2014 BWC matcher teardown and rehash driven by eswitch/TC-flower/conntrack hardware-offload configuration via netlink \\u2014 not from received network packets. This matches the AV:L scoring of all sibling mlx5 HWS CVEs.\\nAC:L - The freed-matcher-on-list condition only arises when a `MODIFY_FLOW_TABLE` firmware command fails mid-disconnect; however, an attacker able to drive matcher create/destroy churn can retry the operation indefinitely, and once the leak occurs the dangling list entry is deterministically dereferenced by the next connect/disconnect/debugfs walk, so exploitation is not gated on a race or on unknowable memory layout.\\nPR:L - Reaching the matcher destroy/rehash path requires the ability to add and remove offloaded steering rules (TC flower / conntrack offload) on an mlx5 device, i.e. CAP_NET_ADMIN over the relevant netdev, which is obtainable by a low-privileged actor holding a delegated network namespace or VF/SF rather than requiring real root in the init namespace.\\nUI:N - No victim action is needed; the freed matcher is left on `tbl-\u003ematchers_list` and is dereferenced by the driver\u0027s own subsequent steering operations with no user involvement.\\nS:U - The corruption is confined to kernel slab memory and mlx5 steering state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The stale entry is read by `list_first_entry`/`list_last_entry` in `table.c:298/408` and by the debugfs dump at `debug.c:233`, which serialises fields of the freed `struct mlx5hws_matcher` to userspace \\u2014 a direct disclosure of reallocated kernel heap contents, and the UAF generally enables arbitrary read after heap grooming.\\nI:H - `hws_matcher_connect()` performs `list_add`/`list_add_tail` through the dangling `list_node`, writing kernel pointers into freed memory that may already hold another object, giving a heap-corruption write primitive; stale `rtc_0_id`/`rtc_1_id` values are also programmed into hardware steering, corrupting packet-forwarding policy.\\nA:H - The commit message states this \\\"leads to use-after-free and eventual crash\\\"; dereferencing the freed matcher reliably produces an oops/panic, and the resulting steering-state corruption also breaks packet forwarding on the NIC.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"472dd792348f6601ccaa97d5626ee4faff891901\", \"lessThan\": \"5682aad0276ff9b9b0eff3188eb6a1f504d6b436\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"472dd792348f6601ccaa97d5626ee4faff891901\", \"lessThan\": \"23a86c76a1a197e8fbbbd0ce3e826eb58c471624\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"472dd792348f6601ccaa97d5626ee4faff891901\", \"lessThan\": \"1ce840c7a659aa53a31ef49f0271b4fd0dc10296\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436\"}, {\"url\": \"https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624\"}, {\"url\": \"https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: HWS, change error flow on matcher disconnect\\n\\nCurrently, when firmware failure occurs during matcher disconnect flow,\\nthe error flow of the function reconnects the matcher back and returns\\nan error, which continues running the calling function and eventually\\nfrees the matcher that is being disconnected.\\nThis leads to a case where we have a freed matcher on the matchers list,\\nwhich in turn leads to use-after-free and eventual crash.\\n\\nThis patch fixes that by not trying to reconnect the matcher back when\\nsome FW command fails during disconnect.\\n\\nNote that we\u0027re dealing here with FW error. We can\u0027t overcome this\\nproblem. This might lead to bad steering state (e.g. wrong connection\\nbetween matchers), and will also lead to resource leakage, as it is\\nthe case with any other error handling during resource destruction.\\n\\nHowever, the goal here is to allow the driver to continue and not crash\\nthe machine with use-after-free error.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.48\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.3\", \"versionStartIncluding\": \"6.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:54:07.723Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21751\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:54:07.723Z\", \"dateReserved\": \"2024-12-29T08:45:45.759Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-27T02:12:22.177Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.