Linux Kernel Vulnerability in IPsec Cleanup Over MPV Devices

CVE-2025-40238

What is CVE-2025-40238?

A vulnerability in the Linux kernel causes a NULL pointer dereference during IPsec cleanup over Multi-path Virtual (MPV) devices. This issue arises when mlx5e_detach_netdev() is called, which disables blocking events notifiers. If this occurs before unregistering the devcom device, subsequent operations may attempt to use an invalid netdev, leading to a crash. This vulnerability can disrupt device operations and requires prompt attention to ensure system stability.

References