{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-13T01:45:04.350","vulnerabilities":[{"cve":{"id":"CVE-2025-21751","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2025-02-27T03:15:15.760","lastModified":"2025-09-19T15:15:48.233","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: HWS, change error flow on matcher disconnect\n\nCurrently, when firmware failure occurs during matcher disconnect flow,\nthe error flow of the function reconnects the matcher back and returns\nan error, which continues running the calling function and eventually\nfrees the matcher that is being disconnected.\nThis leads to a case where we have a freed matcher on the matchers list,\nwhich in turn leads to use-after-free and eventual crash.\n\nThis patch fixes that by not trying to reconnect the matcher back when\nsome FW command fails during disconnect.\n\nNote that we're dealing here with FW error. We can't overcome this\nproblem. This might lead to bad steering state (e.g. wrong connection\nbetween matchers), and will also lead to resource leakage, as it is\nthe case with any other error handling during resource destruction.\n\nHowever, the goal here is to allow the driver to continue and not crash\nthe machine with use-after-free error."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: HWS, cambiar el flujo de error en la desconexión del comparador Actualmente, cuando ocurre una falla de firmware durante el flujo de desconexión del comparador, el flujo de error de la función vuelve a conectar el comparador y devuelve un error, que continúa ejecutando la función de llamada y finalmente libera el comparador que se está desconectando. Esto lleva a un caso en el que tenemos un comparador liberado en la lista de comparadores, lo que a su vez lleva a un use after free y un eventual bloqueo. Este parche lo corrige al no intentar volver a conectar el comparador cuando algún comando de FW falla durante la desconexión. Tenga en cuenta que aquí estamos tratando con un error de FW. No podemos superar este problema. Esto puede llevar a un mal estado de dirección (por ejemplo, conexión incorrecta entre comparadores) y también conducirá a una fuga de recursos, como es el caso con cualquier otro manejo de errores durante la destrucción de recursos. Sin embargo, el objetivo aquí es permitir que el controlador continúe y no bloquee la máquina con un error de use after free."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.3","matchCriteriaId":"BE4E9494-C003-4567-B9CB-CF0C8429C517"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"]},{"url":"https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}]}