CVE-2025-38109: net/mlx5: Fix ECVF vports unload on shutdown flow

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 6.5affected
  • a7719b29a82199b90ebbf355d3332e0fbfbf6045 and later · before 5953ae44dfe5dbad374318875be834c3b7b71ee6affected · git
  • a7719b29a82199b90ebbf355d3332e0fbfbf6045 and later · before da15ca0553325acf68039015f2f4db750c8e2b96affected · git
  • a7719b29a82199b90ebbf355d3332e0fbfbf6045 and later · before 24db585d369f949f698e03d7d8017e5ae19d0497affected · git
  • a7719b29a82199b90ebbf355d3332e0fbfbf6045 and later · before 687560d8a9a2d654829ad0da1ec24242f1de711daffected · git
  • before 6.5not affected · semver
  • 6.6.94 and later · up to and including 6.6.*not affected · semver
  • 6.12.34 and later · up to and including 6.12.*not affected · semver
  • 6.15.3 and later · up to and including 6.15.*not affected · semver
  • 6.16 and laternot affected · original_commit_for_fix

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2025-38101Jul 3, 2025 · ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()
  31Monitor
• ← EarlierCVE-2025-38106Jul 3, 2025 · io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
  31Monitor
• Later →CVE-2025-38114Jul 3, 2025 · e1000: Move cancel_work_sync to avoid deadlock
  22Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.