CVE-2025-38628

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A flaw exists in the Linux kernel's vdpa/mlx5 component related to the release of uninitialized resources during error handling. Specifically, the mlx5 vdpa destroy mr resources() and mlx5 cmd cleanup async ctx() functions were unable to handle uninitialized resources, leading to a kernel splat when adding a vdpa device without a MAC address. The fix ensures that mlx5 vdpa free() is the single entry point for removing vdpa device resources, even in cleanup paths, and that all called functions can handle uninitialized resources.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.