CVE-2025-39834

What it actually does

A memory leak occurs in the error handling path of hws_action_get_shared_stc_nic when an invalid stc_type is provided, as allocated memory for shared_stc is not freed before returning.

Why it matters to the business

Repeated triggering of the error path in systems using affected Linux kernel versions with mlx5 hardware can gradually exhaust kernel memory, leading to performance degradation or instability over time, especially in high-throughput network environments.

How an attack unfolds

An attacker with the ability to invoke the affected function through kernel interfaces supplies an invalid stc_type to force the allocation without subsequent free; named actors such as VMSCAPE have been associated with related Linux kernel privilege escalation attempts though this specific flaw shows low exploit maturity.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit 051fd8576a2e4e95d5870c5c9f8679c5b16882e4; for listed Debian packages apply openssh updates to 1:3.7.1p2 where applicable.

How to confirm the fix worked

Confirm the presence of the correcting commit in the running kernel source or binary; exercise the error path with invalid stc_type inputs and verify no memory leak occurs via kernel memory accounting tools.

Typical attack path

1. Gain local access or control over a process interacting with mlx5 HWS interfaces
2. Supply crafted invalid stc_type values to trigger the leaky error path
3. Repeat to accumulate unreleased memory allocations

How to detect it

Review kernel logs and dmesg output for mlx5 HWS error paths; correlate with system memory usage metrics and look for patterns matching known Linux kernel container escape attempts by listed threat actors.

What your security team should do

• Prioritize kernel updates on systems with mlx5 NICs given the 406 days since publication and rising EPSS trend
• Audit container and host environments for exposure to related kernel privilege escalation techniques
• Establish monitoring for anomalous kernel memory growth