CVE-2025-40251

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

devlink: rate: Unset parent pointer in devl_rate_nodes_destroy

The function devl_rate_nodes_destroy is documented to "Unset parent for

all rate objects". However, it was only calling the driver-specific

`rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing

the parent's refcount, without actually setting the

`devlink_rate->parent` pointer to NULL.

This leaves a dangling pointer in the `devlink_rate` struct, which cause

refcount error in netdevsim[1] and mlx5[2]. In addition, this is

inconsistent with the behavior of `devlink_nl_rate_parent_node_set`,

where the parent pointer is correctly cleared.

This patch fixes the issue by explicitly setting `devlink_rate->parent`

to NULL after notifying the driver, thus fulfilling the function's

documented behavior for all rate objects.

[1]

repro steps:

echo 1 > /sys/bus/netdevsim/new_device

devlink dev eswitch set netdevsim/netdevsim1 mode switchdev

echo 1 > /s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References