CVE-2025-38020
NoneCVSS
—
EPSS
0.2%
Published
Jun 18, 2025
CISA due date
—
Cloudanix analysis
A flaw in Linux network drivers for certain hardware can make computers crash when trying to set up a specific security feature on an unsupported network setup.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Null pointer dereference in mlx5e_macsec_add_secy when NETIF_F_HW_MACSEC remains set on an uplink representor netdevice that lacks MACsec offload support in switchdev mode.
Why it matters to the business
Linux systems using affected Mellanox network hardware can experience kernel crashes and service interruptions when MACsec offload configuration is attempted on unsupported representor profiles.
How an attack unfolds
An attacker with local network configuration privileges sends a netlink message via the macsec_upd_offload path to add a security association; because the feature bit was not cleared, the driver dereferences a null pointer in __mutex_lock inside mlx5e_macsec_add_secy, triggering an oops.
How to fix it
Update the Linux kernel to a version containing commit 1e577aeb51e9deba4f2c10edfcb07cb3cb406598 which clears NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features(). Reboot after upgrade.
How to confirm the fix worked
Confirm the fix is present by checking kernel source or git log for commit 1e577aeb51e9deba4f2c10edfcb07cb3cb406598; attempt to reproduce the original configuration change and verify no oops occurs in dmesg.
Typical attack path
- Switch device to uplink representor profile without clearing NETIF_F_HW_MACSEC
- Issue macsec netlink command or ip link set to add offload security association
- Kernel invokes mlx5e_macsec_add_secy on unsupported device
- Null pointer dereference causes general protection fault and system oops
How to detect it
Search kernel logs and dmesg for oops messages containing __mutex_lock, general protection fault, and call traces mentioning mlx5e_macsec_add_secy or macsec_upd_offload; correlate with netlink activity from the ip command or genl_family_rcv_msg.
- mlx5e_macsec_add_secy+0xf9/0x700
- Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f
- KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]
- macsec_upd_offload+0x2c8/0x380
What your security team should do
- Prioritize kernel updates on systems exposing mlx5 uplink representors
- Audit network configuration scripts for MACsec offload usage on representor profiles
- Monitor kernel logs for general protection faults referencing mlx5e_macsec_add_secy
- Apply the fix in all downstream stable kernels before the next scheduled maintenance window
The record
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, the MACsec offload feature must be cleared from the netdevice's features. If left enabled, attempts to add offloads result in a null pointer dereference, as the uplink representor does not support MACsec offload even though the feature bit remains set. Clear NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features(). Kernel log: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4_for_upstream_debug_2025_03_02_17_35 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__mutex_lock+0x128/0x1dd0 Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff RSP: 0018:ffff888147a4f160 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078 RBP: ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000 FS: 00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 Call Trace: <TASK> ? die_addr+0x3d/0xa0 ? exc_general_protection+0x144/0x220 ? asm_exc_general_protection+0x22/0x30 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? __mutex_lock+0x128/0x1dd0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? mutex_lock_io_nested+0x1ae0/0x1ae0 ? lock_acquire+0x1c2/0x530 ? macsec_upd_offload+0x145/0x380 ? lockdep_hardirqs_on_prepare+0x400/0x400 ? kasan_save_stack+0x30/0x40 ? kasan_save_stack+0x20/0x40 ? kasan_save_track+0x10/0x30 ? __kasan_kmalloc+0x77/0x90 ? __kmalloc_noprof+0x249/0x6b0 ? genl_family_rcv_msg_attrs_parse.constprop.0+0xb5/0x240 ? mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] mlx5e_macsec_add_secy+0xf9/0x700 [mlx5_core] ? mlx5e_macsec_add_rxsa+0x11a0/0x11a0 [mlx5_core] macsec_update_offload+0x26c/0x820 ? macsec_set_mac_address+0x4b0/0x4b0 ? lockdep_hardirqs_on_prepare+0x284/0x400 ? _raw_spin_unlock_irqrestore+0x47/0x50 macsec_upd_offload+0x2c8/0x380 ? macsec_update_offload+0x820/0x820 ? __nla_parse+0x22/0x30 ? genl_family_rcv_msg_attrs_parse.constprop.0+0x15e/0x240 genl_family_rcv_msg_doit+0x1cc/0x2a0 ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240 ? cap_capable+0xd4/0x330 genl_rcv_msg+0x3ea/0x670 ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 ? lockdep_set_lock_cmp_fn+0x190/0x190 ? macsec_update_offload+0x820/0x820 netlink_rcv_skb+0x12b/0x390 ? genl_family_rcv_msg_dumpit+0x2a0/0x2a0 ? netlink_ack+0xd80/0xd80 ? rwsem_down_read_slowpath+0xf90/0xf90 ? netlink_deliver_tap+0xcd/0xac0 ? netlink_deliver_tap+0x155/0xac0 ? _copy_from_iter+0x1bb/0x12c0 genl_rcv+0x24/0x40 netlink_unicast+0x440/0x700 ? netlink_attachskb+0x760/0x760 ? lock_acquire+0x1c2/0x530 ? __might_fault+0xbb/0x170 netlink_sendmsg+0x749/0xc10 ? netlink_unicast+0x700/0x700 ? __might_fault+0xbb/0x170 ? netlink_unicast+0x700/0x700 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x53f/0x760 ? import_iovec+0x7/0x10 ? kernel_sendmsg+0x30/0x30 ? __copy_msghdr+0x3c0/0x3c0 ? filter_irq_stacks+0x90/0x90 ? stack_depot_save_flags+0x28/0xa30 ___sys_sen ---truncated---
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux-6.1 | 0 | 6.1.140-1~deb11u1 |
| Debian:12 | linux | 0 | 6.1.140-1 |
| Debian:13 | linux | 0 | 6.12.30-1 |
| Debian:14 | linux | 0 | 6.12.30-1 |
| Linux | Kernel | 6.1.0 | 6.1.140 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_13 | 0 | 1-150600.1.5.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_13 | 0 | 1-150600.13.6.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.60.5.150600.12.26.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.28.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.60.3 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.60.3 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.60.4 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.43.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.43.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.43.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.44.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.44.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.44.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.60.3 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.43.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.60.5 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.60.5.150600.12.26.4 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.60.3 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.60.3 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.60.2 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.43.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.60.4 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.43.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.44.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.60.4 |
Related vulnerabilities
- CVE-2025-38177 In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make… Also affects linux-6.1
- CVE-2025-38095 In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert… Also affects linux-6.1
- CVE-2025-38094 In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb… Also affects linux-6.1
- CVE-2025-38023 In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure… Also affects linux-6.1
- CVE-2025-38027 In the Linux kernel, the following vulnerability has been resolved: regulator: max20086… Also affects linux-6.1
- CVE-2025-38024 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix… Also affects linux-6.1
- CVE-2025-38015 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix… Also affects linux-6.1
- CVE-2025-38018 In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel… Also affects linux-6.1