Kernel Vulnerability in Linux Affecting Mellanox Technologies Products

CVE-2025-39947

What is CVE-2025-39947?

A vulnerability in the Linux kernel related to Mellanox Technologies' network driver has been identified. The issue arises when the mlx5_uplink_netdev_get() function attempts to retrieve the uplink netdevice pointer. If the netdevice has been unbound from the mlx5_core.eth driver, this can lead to the pointer being NULL, resulting in a kernel panic. This vulnerability highlights the need for thorough pointer validation before usage to ensure system stability and prevent crashes. Proper checks and the use of reference counting like netdev_hold() are crucial to safeguard against such issues.

References