CVE-2025-68816

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel’s networking subsystem, specifically the mlx5 firmware tracer, contained a flaw where format string parameters were not properly validated. This allowed potentially malicious firmware to supply format strings with unsafe specifiers (like %s, %p, or %n). These unsafe format strings could lead to crashes or other unpredictable behavior. A function, mlx5 tracer validate params(), was added to validate format specifiers, limiting them to safe integer/hex formats such as %x, %d, %i, %u, %llx, %lx, and so on. Invalid format strings are now flagged in trace output with a "BAD FORMAT: " prefix.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.