CVE-2025-39830

What it actually does

Missing kfree of the buddy allocator structure in the error path of hws_pool_buddy_init leads to a memory leak in the mlx5 HWS driver.

Why it matters to the business

Systems using affected MLX5 hardware may experience gradual memory exhaustion over repeated error conditions during pool initialization, increasing operational overhead especially in high-availability or containerized Linux environments.

How an attack unfolds

An attacker would need to trigger repeated error paths in hws_pool_buddy_init on systems with MLX5 NICs; no public exploitation or named threat actors are associated with this leak.

How to fix it

Update Linux kernel to a version containing commit 86d13a6f49cb68aa91bd718b1b627e72e77285c1 or later; for affected packages such as asterisk on Debian 11 apply the 0.5.0 fixed release where available.

How to confirm the fix worked

Confirm presence of the kfree call in hws_pool_buddy_init error handling after applying the patch; review kernel memory usage patterns under mlx5 HWS initialization stress tests.

Typical attack path

1. Trigger conditions that cause hws_pool_buddy_init to enter its error path
2. Allocator structure is allocated but not freed due to missing kfree
3. Repeated triggers accumulate leaked memory until system impact

How to detect it

Review kernel logs and memory accounting for repeated mlx5 HWS pool initialization failures without corresponding frees; correlate with dmesg entries mentioning hws_pool_buddy_init.

What your security team should do

• Prioritize patching kernel packages containing the mlx5 HWS fix within standard maintenance windows given low EPSS and absence from KEV
• Monitor memory metrics on systems with MLX5 hardware for unexpected growth correlated with driver initialization errors
• Apply the exact fixed commit 86d13a6f49cb68aa91bd718b1b627e72e77285c1 when rebuilding from the stable git tree