CVE-2025-38109

What it actually does

Use-after-free in mlx5_eswitch_unload_ec_vf_vports during shutdown when ECVF vports are present on BlueField devices; the vport ACL ingress table is not destroyed, causing refcount underflow in tree_put_node and mlx5_destroy_flow_table.

Why it matters to the business

Unexpected kernel warnings or crashes during reboot on systems using BlueField ECVF SR-IOV configurations; limited operational impact because the flaw is triggered only on specific hardware during shutdown and is not known to be exploited in the wild.

How an attack unfolds

An attacker with local access or the ability to initiate shutdown on a BlueField-equipped host enables ECVF vports, then triggers mlx5_sriov_detach during reboot; the missing ingress table destruction leads to a refcount underflow that can be leveraged for memory corruption or denial of service.

How to fix it

Update the Linux kernel to a version containing commit 5953ae44dfe5dbad374318875be834c3b7b71ee6 or install Chainguard packages amazon-cloudwatch-agent-operator-fips and amazon-cloudwatch-agent-operator-fips-compat at version 3.0.1-r1 or newer.

How to confirm the fix worked

Boot a patched kernel on affected hardware, enable ECVF vports, perform repeated shutdown/reboot cycles, and confirm absence of the refcount_warn_saturate and mlx5_destroy_flow_table warnings in dmesg.

Typical attack path

1. Enable ECVF vports on a BlueField device
2. Perform SR-IOV configuration change or initiate system reboot
3. Trigger mlx5_unload path that calls esw_acl_ingress_lgcy_cleanup without proper table destruction
4. Observe refcount underflow warning and potential UAF

How to detect it

Search kernel logs and dmesg for the exact strings refcount_t: underflow and the call trace symbols tree_put_node, mlx5_destroy_flow_table, esw_acl_ingress_table_destroy, and mlx5_eswitch_unload_ec_vf_vports around the time of shutdown or reboot events.

• refcount_t: underflow; use-after-free.
• WARNING: CPU.*refcount_warn_saturate
• tree_put_node+0x164/0x1e0 [mlx5_core]
• mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core]
• esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core]
• mlx5_eswitch_unload_ec_vf_vports

What your security team should do

• Apply the referenced kernel commit or package updates to all BlueField hosts within the next maintenance window
• Add kernel log monitoring rules for refcount underflow messages containing mlx5_core symbols
• Verify that ECVF vport usage is documented and limited to required workloads