CVE-2025-38590

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Remove skb secpath if xfrm state is not found

Hardware returns a unique identifier for a decrypted packet's xfrm

state, this state is looked up in an xarray. However, the state might

have been freed by the time of this lookup.

Currently, if the state is not found, only a counter is incremented.

The secpath (sp) extension on the skb is not removed, resulting in

sp->len becoming 0.

Subsequently, functions like __xfrm_policy_check() attempt to access

fields such as xfrm_input_state(skb)->xso.type (which dereferences

sp->xvec[sp->len - 1]) without first validating sp->len. This leads to

a crash when dereferencing an invalid state pointer.

This patch prevents the crash by explicitly removing the secpath

extension from the skb if the xfrm state is not found after hardware

decryption. This ensures downstream functions do not operate on a

zero-length secpath.

BUG: unable to handle page fault for address: ffff

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References