CVE-2025-68816

What it actually does

Improper validation of format string parameters in the firmware tracer allows malformed format specifiers from device firmware to cause crashes or undefined behavior such as arbitrary memory access.

Why it matters to the business

Systems using affected Mellanox network adapters may experience kernel crashes or instability if malicious or faulty firmware is present, potentially leading to downtime in network-intensive environments.

How an attack unfolds

An attacker with the ability to influence or replace firmware on the device could supply a malicious format string containing unsafe specifiers like %s or %n, which the tracer would process without validation, leading to crashes or exploitation attempts.

How to fix it

Update the Linux kernel to the fixed commit 95624b731c490a4b849844269193a233d6d556a0 or later versions that include mlx5_tracer_validate_params().

How to confirm the fix worked

Verify the presence of the validation function mlx5_tracer_validate_params() in the kernel source or check that the commit is applied; monitor trace logs for 'BAD_FORMAT:' prefixes on invalid strings.

Typical attack path

1. Compromise or control device firmware
2. Send malformed format string via firmware tracer
3. Trigger trace message formatting
4. Cause crash or undefined behavior

How to detect it

Inspect system logs and trace outputs for 'BAD_FORMAT:' prefixed messages indicating invalid format strings were received; look for kernel oops or crashes involving mlx5 fw_tracer functions.

• BAD_FORMAT:
• mlx5_tracer_validate_params
• fw_tracer

What your security team should do

• Apply the kernel patch immediately for systems with mlx5 devices
• Monitor for firmware updates from vendors
• Enable enhanced logging for firmware tracer