CVE-2025-39768CWE-617

CVE-2025-39768

Medium · published September 11, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
2.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, fix complex rules rehash error flow

Moving rules from matcher to matcher should not fail.

However, if it does fail due to various reasons, the error flow

should allow the kernel to continue functioning (albeit with broken

steering rules) instead of going into series of soft lock-ups or

some other problematic behaviour.

Similar to the simple rules, complex rules rehash logic suffers

from the same problems. This patch fixes the error flow for moving

complex rules:

- If new rule creation fails before it was even enqeued, do not

poll for completion

- If TIMEOUT happened while moving the rule, no point trying

to poll for completions for other rules. Something is broken,

completion won't come, just abort the rehash sequence.

- If some other completion with error received, don't give up.

Continue handling rest of the rules to minimize the damage.

- Make sure that the first error code that was received will

be actually returned to the caller instead of replacing it

with the generic error code.

All the aforementioned issues stem from the same bad error flow,

so no point fixing them one by one and leaving partially broken

code - fixing them in one patch.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.5th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2025-09-11T21:15Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 6.16, < 6.16.46.16.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (2)
EPSS history
Timeline
  • 11 SEP 16:56Z
    net/mlx5: HWS, fix complex rules rehash error flow
    cvelistv5