CVE-2025-23263: NVIDIA DOCA Privilege Escalation Flaw

CVE-2025-23263 Overview

CVE-2025-23263 is a high-severity vulnerability affecting NVIDIA DOCA-Host and Mellanox OFED (OpenFabrics Enterprise Distribution) network stacks. The flaw resides in the VGT+ (VLAN Guest Tagging Plus) feature, which controls VLAN tag handling for virtual machines connected through NVIDIA ConnectX and BlueField adapters. An attacker with access to a guest virtual machine can exploit improperly assigned permissions [CWE-279] to escalate privileges on the VLAN and cause denial of service to co-tenant traffic. The vulnerability requires adjacent network access and low privileges, with no user interaction. NVIDIA published mitigation guidance through its customer support portal on July 17, 2025.

Critical Impact
A VM tenant can break VLAN isolation, disrupt neighboring workloads on the shared network, and gain elevated privileges over VLAN configuration.

Affected Products

NVIDIA DOCA-Host (VGT+ feature enabled)
NVIDIA Mellanox OFED (VGT+ feature enabled)
Virtualized environments using ConnectX and BlueField adapters with VGT+ pass-through

Discovery Timeline

2025-07-17 - CVE-2025-23263 published to the National Vulnerability Database
2025-07-17 - NVIDIA publishes advisory via NVIDIA Customer Support Answer 5654
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23263

Vulnerability Analysis

The vulnerability affects the VGT+ feature in NVIDIA DOCA-Host and Mellanox OFED drivers. VGT+ is an enhancement to standard VLAN Guest Tagging that permits a guest VM to send and receive 802.1Q-tagged frames within an administrator-defined allow list of VLAN IDs. The hypervisor host is expected to enforce which VLAN tags a VM function may use.

The flaw stems from incorrectly assigned permissions [CWE-279] in the VGT+ enforcement path. A malicious tenant on a guest VM can inject or manipulate VLAN-tagged traffic beyond the intended allow list. This breaks the tenant isolation model that VGT+ is designed to enforce.

Successful exploitation results in high integrity and availability impact on the VLAN, with low confidentiality impact. Neighboring VMs sharing the fabric can experience traffic disruption or loss of network availability.

Root Cause

The root cause is CWE-279: Incorrect Execution-Assigned Permissions. The VGT+ code path assigns VLAN operation privileges to VM contexts that should be restricted to the hypervisor or SR-IOV Physical Function. Guest Virtual Functions inherit permissions they should not possess, allowing tag manipulation and privileged VLAN operations from within a VM.

Attack Vector

Exploitation requires the attacker to hold low-privileged access on a guest VM whose virtual function is bound to a NIC running an affected DOCA-Host or Mellanox OFED build with VGT+ enabled. The attacker issues VLAN configuration or tagging operations through the guest driver interface. Because the adjacent network attack vector applies, the attacker must be on the same Layer 2 segment or share the physical fabric. No social engineering or user interaction is required.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the NVIDIA Customer Support Answer for vendor-provided technical details.

Detection Methods for CVE-2025-23263

Indicators of Compromise

Unexpected 802.1Q VLAN tags observed on VM egress traffic outside the tenant's authorized VLAN allow list
Sudden loss of connectivity or high packet loss on VLANs shared with tenant VMs on NVIDIA ConnectX or BlueField adapters
Driver or mlx5_core kernel log entries referencing VGT+ policy changes originating from a Virtual Function
Anomalous VLAN table modifications on Physical Functions correlated with guest VM activity

Detection Strategies

Compare per-VF VLAN allow lists configured at the hypervisor against the tags observed on the wire using span or mirror ports
Enable and audit driver logs on hosts running DOCA-Host or Mellanox OFED for VGT+ policy events
Correlate hypervisor VF configuration events with guest VM process activity to identify tenants issuing unauthorized VLAN operations

Monitoring Recommendations

Aggregate NIC driver logs, hypervisor events, and switch VLAN counters into a centralized SIEM for cross-source correlation
Alert on any VLAN ID appearing on a VF that is not in that VF's provisioned allow list
Track baseline traffic volumes per VLAN and alert on sharp deviations that may indicate DoS conditions caused by tag manipulation

How to Mitigate CVE-2025-23263

Immediate Actions Required

Inventory all hosts running NVIDIA DOCA-Host or Mellanox OFED and identify systems with VGT+ enabled on Virtual Functions
Apply the fixed driver versions referenced in NVIDIA Customer Support Answer 5654
Restrict VGT+ configuration to trusted tenants only until patched builds are deployed across the fleet
Review VF-to-VLAN mappings and remove any VLAN allow-list entries that are not strictly required

Patch Information

NVIDIA has published fixed versions and mitigation guidance through the vendor advisory at NVIDIA Customer Support Answer 5654. Administrators should upgrade DOCA-Host and Mellanox OFED to the versions specified by NVIDIA and reload the affected kernel modules, or reboot the host, to activate the fix.

Workarounds

Disable the VGT+ feature on Virtual Functions where it is not required, reverting to standard VGT or VST modes
Enforce strict VLAN allow lists at the physical switch to bound the blast radius of any tag manipulation
Isolate multi-tenant workloads onto separate physical fabrics or dedicated adapters when patching is not immediately feasible

bash

# Example: disable VGT+ and restrict a VF to a single VLAN on the hypervisor
# Replace <PF> with the Physical Function interface (for example, enp1s0f0)
# Replace <VF_INDEX> and <VLAN_ID> with your environment values
ip link set dev <PF> vf <VF_INDEX> vlan <VLAN_ID>
ip link set dev <PF> vf <VF_INDEX> trust off
ip link set dev <PF> vf <VF_INDEX> spoofchk on