CVE-2025-40238

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6 for upstream min debug 2024 11 08 00 46

Description The Linux kernel contains a flaw within the mlx5 network driver related to IPsec cleanup over MPV devices. Specifically, the issue arises during the mlx5e detach netdev() process, where blocking events are disabled without first properly unregistering the devcom device and marking device operations as complete. This can lead to invalid netdev usage during subsequent devcom events, potentially resulting in a kernel NULL pointer dereference. The vulnerability is triggered when handling IPsec MPV events from IB to core.

Recommendations Upgrade to Linux kernel version 6.12.0-rc6 for upstream min debug 2024 11 08 00 46 or a later version that includes the fix.