CVE-2025-21970

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Bridge, fix the crash caused by LAG state check

When removing LAG device from bridge, NETDEV_CHANGEUPPER event is

triggered. Driver finds the lower devices (PFs) to flush all the

offloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns

false if one of PF is unloaded. In such case,

mlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of

the alive PF, and the flush is skipped.

Besides, the bridge fdb entry's lastuse is updated in mlx5 bridge

event handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be

ignored in this case because the upper interface for bond is deleted,

and the entry will never be aged because lastuse is never updated.

To make things worse, as the entry is alive, mlx5 bridge workqueue

keeps sending that event, which is then handled by kernel bridge

notifier. It causes the following crash when accessing the passed bond

netdev which is already destroyed.

To fix t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References