Out-of-Bounds Access Vulnerability in Linux Kernel's mlx5e Module

CVE-2025-21717

Summary

A vulnerability exists in the Linux kernel's mlx5e module where the kvzalloc_node function does not perform a runtime check on the node argument. This lack of validation can lead to out-of-bounds access during ethtool and netlink operations, particularly when the mlx5e_open function is called on a CPU that exceeds the maximum number of nodes. The scenario can result in a kernel panic due to memory access violations, potentially destabilizing the system. Adding a missing cpu_to_node call has been identified as a necessary fix to ensure proper node ID conversion.

References