CVE-2025-68209

What it actually does

Default CQ creation in the mlx5 driver assigns an inappropriate completion handler and leaves a valid arm_db value, allowing an EQ interrupt to invoke a user-CQ-only function on a polling-only kernel CQ and trigger a NULL pointer dereference.

Why it matters to the business

Systems using the affected mlx5 driver may experience unexpected kernel crashes during normal operation or under crafted workloads, leading to downtime, service interruption, and the need for urgent patching on thousands of dependent packages across Linux distributions.

How an attack unfolds

An attacker with the ability to influence CQ creation or trigger EQ events (local or via hardware interaction) causes the mlx5 driver to invoke an uninitialized completion function on a kernel CQ, resulting in a NULL pointer dereference crash; the root cause was not fully mitigated by prior one-off fixes.

How to fix it

Upgrade to a fixed kernel containing commit 08469f5393a1a39f26a6e2eb2e8c33187665c1f4 or later; for Chainguard/Wolfi stern packages upgrade to 1.32.0-r1 or newer. Rebuild and reboot systems after applying the update; callers of mlx5_core_create_cq must still initialize their own completion functions and arm the CQ.

How to confirm the fix worked

Verify the running kernel contains commit 08469f5393a1a39f26a6e2eb2e8c33187665c1f4 or equivalent fixed version; inspect mlx5 CQ creation paths to confirm a dummy completion handler and invalid command sequence number are set by default for kernel CQs.

Typical attack path

1. Trigger mlx5_core_create_cq for a polling-only kernel CQ without setting a completion function
2. Ensure the CQ uses doorbells but is intended for polling only
3. Cause an EQ interrupt to fire on the CQ
4. mlx5_add_cq_to_tasklet is invoked, dereferencing an invalid pointer and crashing the kernel

How to detect it

Review kernel crash logs for NULL pointer dereferences originating in mlx5 CQ completion paths; search dmesg or syslog for mlx5_add_cq_to_tasklet references on kernel CQs; no widespread in-the-wild exploitation indicators have been published.

What your security team should do

• Prioritize patching all mlx5-based systems to the fixed commit or package version 1.32.0-r1 within the next maintenance window
• Monitor EPSS trend for any future increase and reassess exploit maturity
• Audit custom mlx5 driver consumers to ensure they correctly arm CQs and supply completion handlers
• Test updated kernels in staging environments that exercise mlx5 CQ creation paths before broad deployment