Improper locking in Linux kernel mlx5 core driver



| Updated: 2025-05-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-21662
CWE-ID CWE-667
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper locking

EUVDB-ID: #VU103129

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21662

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the cmd_work_handler() function in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1 - 6.1.124

CPE2.3 External links

https://git.kernel.org/stable/c/0e2909c6bec9048f49d0c8e16887c63b50b14647
https://git.kernel.org/stable/c/229cc10284373fbe754e623b7033dca7e7470ec8
https://git.kernel.org/stable/c/36124081f6ffd9dfaad48830bdf106bb82a9457d
https://git.kernel.org/stable/c/f0a2808767ac39f64b1d9a0ff865c255073cf3d4
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.125


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###