CVE-2025-39979

Vulnerability

Overview

A use-after-free (UAF) vulnerability exists in the Mellanox MLX5 flow steering (fs) subsystem in the Linux kernel. When deleting a flow table entry (FTE) via mlx5_cmd_hws_delete_fte(), the code attempts to release an HWS action associated with a local flow counter. However, the HWS action structure's refcount and mutex were not properly initialized, and the underlying counter struct could already have been freed by the time the action release runs. This race condition leads to a kernel trace and potential system crash [1].

Exploitation

Prerequisites

The issue can be triggered by any user or process that has the capability to create and destroy InfiniBand (IB) flow steering rules using the mlx5_ib driver and the ib_uverbs interface. This typically requires local access with sufficient privileges to interact with the InfiniBand subsystem, though the exact user namespace requirements depend on system configuration. The attacker does not need physical access—only the ability to issue the appropriate ioctl calls that invoke mlx5_ib_destroy_flow() and ultimately lead to the vulnerable code path [1].

Impact

A successful exploit results in a kernel crash (panic or Oops), leading to a denial of service (DoS) condition on the affected system. There is no evidence in the provided sources of an information leak or privilege escalation, but the instability can disrupt system availability indefinitely [1].

Mitigation

The fix is included in the Linux kernel stable commit 3c77f6d244188c3fb11f6aec40bbfe884f1803b5. This commit adds proper initialization of the HWS action's refcount and mutex, and introduces a reference count for the local flow counter structure to prevent premature freeing. System administrators should apply the latest kernel updates from their distribution. No workaround is documented in the advisory. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) list at this time [1].