CVE-2025-39979

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39979", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.150Z", "datePublished": "2025-10-15T07:55:59.609Z", "dateUpdated": "2026-10-15T22:02:35.358Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:48.313Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n <TASK>\n dump_stack_lvl+0x34/0x48\n mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n del_hw_fte+0x1ce/0x260 [mlx5_core]\n mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n ? ttwu_queue_wakelist+0xf4/0x110\n mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n uverbs_free_flow+0x20/0x50 [ib_uverbs]\n destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n uobj_destroy+0x3c/0x80 [ib_uverbs]\n ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n ? do_tty_write+0x1a9/0x270\n ? file_tty_write.constprop.0+0x98/0xc0\n ? new_sync_write+0xfc/0x190\n ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n __x64_sys_ioctl+0x87/0xc0\n do_syscall_64+0x59/0x90"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The only route to the vulnerable code is the `MLX5_IB_METHOD_CREATE_FLOW`/destroy-flow uverbs ioctl on the local `/dev/infiniband/uverbsN` character device (created world-accessible at mode 0666), as shown by the `__x64_sys_ioctl` \u2192 `ib_uverbs_ioctl` \u2192 `mlx5_ib_destroy_flow` call trace. No remote packet or peer data reaches this path.\nAC:L - This is not a race \u2014 `mlx5_del_flow_rules()` frees the local counter in `del_sw_hw_rule()` and then unconditionally reuses it in `del_hw_fte()` \u2192 `mlx5_cmd_hws_delete_fte()` within the same call, so every teardown of a DEVX-counter flow rule deterministically triggers the UAF, and the attacker fully controls both the create and destroy ioctls plus any heap-spray thread.\nPR:L - The attacker needs only the partial CAP_NET_RAW capability, not real root/admin \u2014 it is granted by default to Docker/OCI containers in the initial user namespace, is routinely handed to DPDK/RDMA and HPC workloads, and the uverbs device node itself is world-readable/writable at 0666. This is a limited privilege on the vulnerable component, not full administrative control.\nUI:N - The attacker performs the entire sequence (create DEVX flow counter, create raw flow rule, destroy the flow uobject) from its own process with ordinary ioctls. No victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory and is exploited to gain kernel privileges within the same security authority as the attacking process. No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `mlx5_fs_put_hws_action()` reads `counter->bulk` and then `fs_hws_data->hws_action` out of freed slab memory; once the object is reclaimed by a sprayed allocation the attacker controls those reads and the subsequent `action->type`/`action->ctx` dereferences in `mlx5hws_action_destroy()`, yielding an arbitrary-pointer read primitive and full kernel memory disclosure.\nI:H - The freed object is written after free \u2014 an atomic RMW via `refcount_dec_not_one()`, a `mutex_lock()`, and `fs_hws_data->hws_action = NULL` \u2014 corrupting whatever structure now occupies the slot, and `mlx5hws_action_destroy()` performs a `kfree()` on a pointer read from attacker-controlled freed memory, an arbitrary-free primitive that is a well-established route to control-flow hijack and privilege escalation.\nA:H - Even without exploitation the bug reliably produces a refcount_t saturation splat, slab corruption, and kernel oops/panic on every flow-rule teardown, and the uninitialized `hws_data.lock` mutex (zeroed `wait_list` with NULL next/prev) causes a NULL dereference or list corruption on any contended `mutex_lock()`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h"], "versions": [{"version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5", "status": "affected", "versionType": "git"}, {"version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.10", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.16.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"}, {"url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"}], "title": "net/mlx5: fs, fix UAF in flow counter release", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:55:44.171884Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:35.358Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:55:44.171884Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:55:44.787Z"}}], "cna": {"title": "net/mlx5: fs, fix UAF in flow counter release", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The only route to the vulnerable code is the `MLX5_IB_METHOD_CREATE_FLOW`/destroy-flow uverbs ioctl on the local `/dev/infiniband/uverbsN` character device (created world-accessible at mode 0666), as shown by the `__x64_sys_ioctl` \u2192 `ib_uverbs_ioctl` \u2192 `mlx5_ib_destroy_flow` call trace. No remote packet or peer data reaches this path.\nAC:L - This is not a race \u2014 `mlx5_del_flow_rules()` frees the local counter in `del_sw_hw_rule()` and then unconditionally reuses it in `del_hw_fte()` \u2192 `mlx5_cmd_hws_delete_fte()` within the same call, so every teardown of a DEVX-counter flow rule deterministically triggers the UAF, and the attacker fully controls both the create and destroy ioctls plus any heap-spray thread.\nPR:L - The attacker needs only the partial CAP_NET_RAW capability, not real root/admin \u2014 it is granted by default to Docker/OCI containers in the initial user namespace, is routinely handed to DPDK/RDMA and HPC workloads, and the uverbs device node itself is world-readable/writable at 0666. This is a limited privilege on the vulnerable component, not full administrative control.\nUI:N - The attacker performs the entire sequence (create DEVX flow counter, create raw flow rule, destroy the flow uobject) from its own process with ordinary ioctls. No victim action or interaction is needed.\nS:U - The use-after-free corrupts kernel slab memory and is exploited to gain kernel privileges within the same security authority as the attacking process. No hypervisor, IOMMU, or other security-authority boundary is crossed.\nC:H - `mlx5_fs_put_hws_action()` reads `counter->bulk` and then `fs_hws_data->hws_action` out of freed slab memory; once the object is reclaimed by a sprayed allocation the attacker controls those reads and the subsequent `action->type`/`action->ctx` dereferences in `mlx5hws_action_destroy()`, yielding an arbitrary-pointer read primitive and full kernel memory disclosure.\nI:H - The freed object is written after free \u2014 an atomic RMW via `refcount_dec_not_one()`, a `mutex_lock()`, and `fs_hws_data->hws_action = NULL` \u2014 corrupting whatever structure now occupies the slot, and `mlx5hws_action_destroy()` performs a `kfree()` on a pointer read from attacker-controlled freed memory, an arbitrary-free primitive that is a well-established route to control-flow hijack and privilege escalation.\nA:H - Even without exploitation the bug reliably produces a refcount_t saturation splat, slab corruption, and kernel oops/panic on every flow-rule teardown, and the uninitialized `hws_data.lock` mutex (zeroed `wait_list` with NULL next/prev) causes a NULL dereference or list corruption on any contended `mutex_lock()`."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5", "versionType": "git"}, {"status": "affected", "version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.16.10", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"}, {"url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n <TASK>\n dump_stack_lvl+0x34/0x48\n mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n del_hw_fte+0x1ce/0x260 [mlx5_core]\n mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n ? ttwu_queue_wakelist+0xf4/0x110\n mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n uverbs_free_flow+0x20/0x50 [ib_uverbs]\n destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n uobj_destroy+0x3c/0x80 [ib_uverbs]\n ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n ? do_tty_write+0x1a9/0x270\n ? file_tty_write.constprop.0+0x98/0xc0\n ? new_sync_write+0xfc/0x190\n ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n __x64_sys_ioctl+0x87/0xc0\n do_syscall_64+0x59/0x90"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.10", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:06:48.313Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39979", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:35.358Z", "dateReserved": "2025-04-16T07:20:57.150Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-15T07:55:59.609Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c77f6d244188c3fb11f6aec40bbfe884f1803b5", "status": "affected", "version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "versionType": "git"}, {"lessThan": "6043819e707cefb1c9e59d6e431dcfa735c4f975", "status": "affected", "version": "b581f4266928d3b5d1bbe711e39623d9a1696091", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/fs_core.c", "drivers/net/ethernet/mellanox/mlx5/core/fs_core.h", "drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c", "drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c", "include/linux/mlx5/fs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n <TASK>\n dump_stack_lvl+0x34/0x48\n mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n del_hw_fte+0x1ce/0x260 [mlx5_core]\n mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n ? ttwu_queue_wakelist+0xf4/0x110\n mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n uverbs_free_flow+0x20/0x50 [ib_uverbs]\n destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n uobj_destroy+0x3c/0x80 [ib_uverbs]\n ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n ? do_tty_write+0x1a9/0x270\n ? file_tty_write.constprop.0+0x98/0xc0\n ? new_sync_write+0xfc/0x190\n ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n __x64_sys_ioctl+0x87/0xc0\n do_syscall_64+0x59/0x90"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5: fs, soluciona UAF en la liberaci\u00f3n del contador de flujo\n\nSoluciona un rastreo del kernel [1] causado por la liberaci\u00f3n de una acci\u00f3n HWS de un contador de flujo local en mlx5_cmd_hws_delete_fte(), donde el recuento de referencias (refcount) y el mutex de la acci\u00f3n HWS no estaban inicializados y la estructura del contador ya podr\u00eda haber sido liberada al eliminar la regla.\n\nSe soluciona a\u00f1adiendo las inicializaciones faltantes y a\u00f1adiendo el recuento de referencias (refcount) para la estructura del contador de flujo local.\n\n[1] Registro del kernel:\n Call Trace:\n <TASK>\n dump_stack_lvl+0x34/0x48\n mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n del_hw_fte+0x1ce/0x260 [mlx5_core]\n mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n ? ttwu_queue_wakelist+0xf4/0x110\n mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n uverbs_free_flow+0x20/0x50 [ib_uverbs]\n destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n uobj_destroy+0x3c/0x80 [ib_uverbs]\n ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n ? do_tty_write+0x1a9/0x270\n ? file_tty_write.constprop.0+0x98/0xc0\n ? new_sync_write+0xfc/0x190\n ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n __x64_sys_ioctl+0x87/0xc0\n do_syscall_64+0x59/0x90"}], "id": "CVE-2025-39979", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39979", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:55:44.171884Z", "version": "2.0.3"}}]}, "published": "2025-10-15T08:15:35.767", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net/mlx5: fs, fix UAF in flow counter release", "id": "2404109", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404109"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39979", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-10-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39979\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39979\nhttps://lore.kernel.org/linux-cve-announce/2025101559-CVE-2025-39979-f1e9@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-20T13:27:13.692412+00:00", "updated": "2025-10-20T13:27:13.692436+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}