CVE-2025-21751 Overview
CVE-2025-21751 is a use-after-free vulnerability [CWE-416] in the Linux kernel's Mellanox net/mlx5 Hardware Steering (HWS) subsystem. The flaw resides in the matcher disconnect error handling path. When a firmware command fails during matcher disconnect, the driver reconnects the matcher and returns an error. The calling function continues execution and frees the matcher, leaving a dangling reference on the matchers list. Subsequent access to the freed matcher triggers use-after-free conditions that can crash the system.
Critical Impact
A local authenticated user with the ability to trigger mlx5 HWS operations under firmware error conditions can cause kernel memory corruption, leading to system crash or potential local privilege escalation.
Affected Products
- Linux kernel versions with net/mlx5 Hardware Steering (HWS) support prior to the fix
- Systems using Mellanox ConnectX network adapters with HWS mode enabled
- Distributions shipping vulnerable stable kernel branches
Discovery Timeline
- 2025-02-27 - CVE-2025-21751 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21751
Vulnerability Analysis
The vulnerability affects the Mellanox 5 (mlx5) Ethernet driver's Hardware Steering (HWS) component in the Linux kernel. HWS manages steering rules through matcher objects that route packets to specific destinations based on match criteria. Matchers are tracked in a linked list within the driver.
The disconnect flow removes a matcher from the active steering pipeline before the caller frees its memory. When a firmware command fails mid-disconnect, the existing error handler attempts recovery by reconnecting the matcher and returning an error code to the caller. The caller does not interpret this error as a stop condition and proceeds to free the matcher regardless. The reconnected matcher, now freed, remains reachable through the matchers list.
Any subsequent traversal of the matchers list dereferences freed memory, producing classic use-after-free behavior. On kernels without hardening mitigations, this can be shaped into arbitrary kernel memory corruption.
Root Cause
The root cause is an inconsistent error-handling contract between the matcher disconnect helper and its caller. The helper's recovery action (reconnect) conflicts with the caller's unconditional free. This produces a lifetime mismatch classified as [CWE-416] Use After Free.
Attack Vector
Exploitation requires local access with privileges sufficient to invoke mlx5 HWS operations that trigger matcher disconnect. An attacker must also induce a firmware command failure to reach the vulnerable error path. Successful exploitation results in kernel memory corruption impacting confidentiality, integrity, and availability of the host.
Detection Methods for CVE-2025-21751
Indicators of Compromise
- Kernel oops or panic messages referencing mlx5_core, HWS matcher functions, or KASAN use-after-free reports
- Unexpected NIC driver resets or steering rule failures preceded by firmware error log entries
- System crashes correlated with heavy steering rule reconfiguration on ConnectX hardware
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) in test environments to catch use-after-free access on matcher structures
- Monitor dmesg for mlx5_core firmware command failures followed by list traversal warnings
- Inventory kernel versions across the fleet and flag hosts running vulnerable builds with Mellanox HWS enabled
Monitoring Recommendations
- Collect and centralize kernel logs to detect firmware failure patterns in mlx5 drivers
- Track NIC firmware versions and correlate crash telemetry with known-vulnerable mlx5 driver builds
- Alert on repeated kernel oops events on hosts handling high steering-rule churn
How to Mitigate CVE-2025-21751
Immediate Actions Required
- Apply the upstream Linux kernel patch that removes the reconnect attempt in the disconnect error path
- Update to a distribution kernel that includes the backported fix from stable trees
- Reboot affected systems after patching to load the corrected mlx5 module
Patch Information
The fix is available in stable Linux kernel commits 1ce840c7a659, 23a86c76a1a1, and 5682aad0276f. The patch changes the error flow so the matcher is not reconnected when a firmware command fails during disconnect, accepting resource leakage rather than risking use-after-free.
Workarounds
- Restrict local access to trusted users on affected hosts until the patched kernel is deployed
- Where feasible, disable mlx5 Hardware Steering mode and fall back to software steering on unpatched systems
- Isolate workloads with untrusted local tenants from hosts using Mellanox ConnectX HWS mode
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
