Dangling Pointer Vulnerability in Linux Kernel's Devlink Rate Functionality

CVE-2025-40251

What is CVE-2025-40251?

A vulnerability exists in the Linux kernel's devlink rate functionality where the 'devlink_rate->parent' pointer is not set to NULL after a parent reference is removed. This error creates a dangling pointer, which can lead to memory management issues, such as refcount errors, in components like 'netdevsim' and 'mlx5'. The issue arises because the function 'devl_rate_nodes_destroy' fails to clear the parent pointer despite correctly notifying the driver. This causes potential memory leaks and system instability during operations that involve adding or removing devlink ports and functions.

References