CVE-2025-21717

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: add missing cpu_to_node to kvzalloc_node in mlx5e_open_xdpredirect_sq

kvzalloc_node is not doing a runtime check on the node argument

(__alloc_pages_node_noprof does have a VM_BUG_ON, but it expands to

nothing on !CONFIG_DEBUG_VM builds), so doing any ethtool/netlink

operation that calls mlx5e_open on a CPU that's larger that MAX_NUMNODES

triggers OOB access and panic (see the trace below).

Add missing cpu_to_node call to convert cpu id to node id.

[ 165.427394] mlx5_core 0000:5c:00.0 beth1: Link up

[ 166.479327] BUG: unable to handle page fault for address: 0000000800000010

[ 166.494592] #PF: supervisor read access in kernel mode

[ 166.505995] #PF: error_code(0x0000) - not-present page

...

[ 166.816958] Call Trace:

[ 166.822380] <TASK>

[ 166.827034] ? __die_body+0x64/0xb0

[ 166.834774] ? page_fault_oops+0x2cd/0x3f0

[ 166.843862] ? exc_page_fault+0x63/0x130

[ 166.852564] ? asm_exc_page_fau

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References