Use-After-Free Vulnerability in Linux Kernel's Matcher Disconnect Flow by Mellanox

CVE-2025-21751

Summary

A vulnerability was identified in the Linux Kernel affecting the matcher disconnect flow. When a firmware failure occurs during this process, the current flow attempts to reconnect the matcher and subsequently returns an error. This leads to a scenario where a freed matcher remains on the matchers list, resulting in a use-after-free condition and a potential system crash. The patch addresses this issue by preventing reconnection attempts when firmware commands fail during disconnect, thereby allowing the driver to continue operating without crashing due to the use-after-free error. This situation can also result in resource leakage and a compromised steering state, emphasizing the importance of robust error handling during resource destruction.

References