{"id":"CVE-2025-39979","summary":"net/mlx5: fs, fix UAF in flow counter release","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fs, fix UAF in flow counter release\n\nFix a kernel trace [1] caused by releasing an HWS action of a local flow\ncounter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and\nmutex were not initialized and the counter struct could already be freed\nwhen deleting the rule.\n\nFix it by adding the missing initializations and adding refcount for the\nlocal flow counter struct.\n\n[1] Kernel log:\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x34/0x48\n  mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]\n  mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]\n  mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]\n  mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]\n  del_hw_fte+0x1ce/0x260 [mlx5_core]\n  mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]\n  ? ttwu_queue_wakelist+0xf4/0x110\n  mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]\n  uverbs_free_flow+0x20/0x50 [ib_uverbs]\n  destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]\n  uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]\n  uobj_destroy+0x3c/0x80 [ib_uverbs]\n  ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]\n  ? uverbs_finalize_object+0x60/0x60 [ib_uverbs]\n  ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]\n  ? do_tty_write+0x1a9/0x270\n  ? file_tty_write.constprop.0+0x98/0xc0\n  ? new_sync_write+0xfc/0x190\n  ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]\n  __x64_sys_ioctl+0x87/0xc0\n  do_syscall_64+0x59/0x90","modified":"2026-04-02T12:48:14.073175Z","published":"2025-10-15T07:55:59.609Z","related":["ALSA-2025:22854","ALSA-2025:22865","SUSE-SU-2025:21080-1","SUSE-SU-2025:21147-1","SUSE-SU-2025:21180-1","openSUSE-SU-2025:20091-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39979.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3c77f6d244188c3fb11f6aec40bbfe884f1803b5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6043819e707cefb1c9e59d6e431dcfa735c4f975"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39979.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39979"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b581f4266928d3b5d1bbe711e39623d9a1696091"},{"fixed":"3c77f6d244188c3fb11f6aec40bbfe884f1803b5"},{"fixed":"6043819e707cefb1c9e59d6e431dcfa735c4f975"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39979.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.16.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39979.json"}}],"schema_version":"1.7.5"}