{"id":"DEBIAN-CVE-2025-40238","details":"In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix IPsec cleanup over MPV device  When we do mlx5e_detach_netdev() we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core.  So before disabling those blocking events, make sure to also unregister the devcom device and mark all this device operations as complete, in order to prevent the other device from using invalid netdev during future devcom events which could cause the trace below.  BUG: kernel NULL pointer dereference, address: 0000000000000010 PGD 146427067 P4D 146427067 PUD 146488067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 1 UID: 0 PID: 7735 Comm: devlink Tainted: GW 6.12.0-rc6_for_upstream_min_debug_2024_11_08_00_46 #1 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] Code: 00 01 48 83 05 23 32 1e 00 01 41 b8 ed ff ff ff e9 60 ff ff ff 48 83 05 00 32 1e 00 01 eb e3 66 0f 1f 44 00 00 0f 1f 44 00 00 \u003c48\u003e 8b 47 10 48 83 05 5f 32 1e 00 01 48 8b 50 40 48 85 d2 74 05 40 RSP: 0018:ffff88811a5c35f8 EFLAGS: 00010206 RAX: ffff888106e8ab80 RBX: ffff888107d7e200 RCX: ffff88810d6f0a00 RDX: ffff88810d6f0a00 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffff88811a17e620 R08: 0000000000000040 R09: 0000000000000000 R10: ffff88811a5c3618 R11: 0000000de85d51bd R12: ffff88811a17e600 R13: ffff88810d6f0a00 R14: 0000000000000000 R15: ffff8881034bda80 FS:  00007f27bdf89180(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000010f159005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  \u003cTASK\u003e  ? __die+0x20/0x60  ? page_fault_oops+0x150/0x3e0  ? exc_page_fault+0x74/0x130  ? asm_exc_page_fault+0x22/0x30  ? mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core]  mlx5e_devcom_event_mpv+0x42/0x60 [mlx5_core]  mlx5_devcom_send_event+0x8c/0x170 [mlx5_core]  blocking_event+0x17b/0x230 [mlx5_core]  notifier_call_chain+0x35/0xa0  blocking_notifier_call_chain+0x3d/0x60  mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core]  mlx5_core_mp_event_replay+0x12/0x20 [mlx5_core]  mlx5_ib_bind_slave_port+0x228/0x2c0 [mlx5_ib]  mlx5_ib_stage_init_init+0x664/0x9d0 [mlx5_ib]  ? idr_alloc_cyclic+0x50/0xb0  ? __kmalloc_cache_noprof+0x167/0x340  ? __kmalloc_noprof+0x1a7/0x430  __mlx5_ib_add+0x34/0xd0 [mlx5_ib]  mlx5r_probe+0xe9/0x310 [mlx5_ib]  ? kernfs_add_one+0x107/0x150  ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib]  auxiliary_bus_probe+0x3e/0x90  really_probe+0xc5/0x3a0  ? driver_probe_device+0x90/0x90  __driver_probe_device+0x80/0x160  driver_probe_device+0x1e/0x90  __device_attach_driver+0x7d/0x100  bus_for_each_drv+0x80/0xd0  __device_attach+0xbc/0x1f0  bus_probe_device+0x86/0xa0  device_add+0x62d/0x830  __auxiliary_device_add+0x3b/0xa0  ? auxiliary_device_init+0x41/0x90  add_adev+0xd1/0x150 [mlx5_core]  mlx5_rescan_drivers_locked+0x21c/0x300 [mlx5_core]  esw_mode_change+0x6c/0xc0 [mlx5_core]  mlx5_devlink_eswitch_mode_set+0x21e/0x640 [mlx5_core]  devlink_nl_eswitch_set_doit+0x60/0xe0  genl_family_rcv_msg_doit+0xd0/0x120  genl_rcv_msg+0x180/0x2b0  ? devlink_get_from_attrs_lock+0x170/0x170  ? devlink_nl_eswitch_get_doit+0x290/0x290  ? devlink_nl_pre_doit_port_optional+0x50/0x50  ? genl_family_rcv_msg_dumpit+0xf0/0xf0  netlink_rcv_skb+0x54/0x100  genl_rcv+0x24/0x40  netlink_unicast+0x1fc/0x2d0  netlink_sendmsg+0x1e4/0x410  __sock_sendmsg+0x38/0x60  ? sockfd_lookup_light+0x12/0x60  __sys_sendto+0x105/0x160  ? __sys_recvmsg+0x4e/0x90  __x64_sys_sendto+0x20/0x30  do_syscall_64+0x4c/0x100  entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f27bc91b13a Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa 96 2c 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff  ---truncated---","modified":"2026-08-27T22:48:43.462880518Z","published":"2025-12-04T16:16:16.830Z","upstream":["CVE-2025-40238"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-40238"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.57-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40238.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.17.6-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-40238.json"}}],"schema_version":"1.9.0"}