CVE-2025-38109

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix ECVF vports unload on shutdown flow

Fix shutdown flow UAF when a virtual function is created on the embedded

chip (ECVF) of a BlueField device. In such case the vport acl ingress

table is not properly destroyed.

ECVF functionality is independent of ecpf_vport_exists capability and

thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not

test it when enabling/disabling ECVF vports.

kernel log:

[] refcount_t: underflow; use-after-free.

[] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28

refcount_warn_saturate+0x124/0x220

----------------

[] Call trace:

[] refcount_warn_saturate+0x124/0x220

[] tree_put_node+0x164/0x1e0 [mlx5_core]

[] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]

[] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]

[] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core]

[] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core]

[] esw_vport_cleanup+0x64/0x90 [mlx5_core]

[] mlx5_es

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References