Kernel Vulnerability in Linux Affecting Mellanox MLX5E and MLX5 Core Drivers

CVE-2025-38387

What is CVE-2025-38387?

In the Linux kernel, a vulnerability has been discovered in the Mellanox MLX5E and MLX5 core drivers related to improper initialization of the obj_event->obj_sub_list prior to insertion. If the list_head remains uninitialized, it may lead to severe crashes due to accessing a poisonous pointer upon immediate use following an insertion. The defect could cause a kernel NULL pointer dereference, potentially disrupting the normal operation of systems utilizing these drivers, necessitating prompt attention and remediation from affected users.

References