CVE-2025-38019

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices

The driver only offloads neighbors that are constructed on top of net

devices registered by it or their uppers (which are all Ethernet). The

device supports GRE encapsulation and decapsulation of forwarded

traffic, but the driver will not offload dummy neighbors constructed on

top of GRE net devices as they are not uppers of its net devices:

# ip link add name gre1 up type gre tos inherit local 192.0.2.1 remote 198.51.100.1

# ip neigh add 0.0.0.0 lladdr 0.0.0.0 nud noarp dev gre1

$ ip neigh show dev gre1 nud noarp

0.0.0.0 lladdr 0.0.0.0 NOARP

(Note that the neighbor is not marked with 'offload')

When the driver is reloaded and the existing configuration is replayed,

the driver does not perform the same check regarding existing neighbors

and offloads the previously added one:

# devlink dev reload pci/0000:01:00.0

$ ip neigh show dev gre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References