In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
The km.state is not checked in driver's delayed work. When xfrm_state_check_expire() is called, the state can be reset to XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This happens when xfrm state is deleted, but not freed yet. As __xfrm_state_delete() is called again in xfrm timer, the following crash occurs.
To fix this issue, skip xfrm_state_check_expire() if km.state is not XFRM_STATE_VALID.
Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core] RIP: 0010:__xfrm_state_delete+0x3d/0x1b0 Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 <48> 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48 RSP: 0018:ffff88885f945ec8 EFLAGS: 00010246 RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036 RDX: dead000000000100 RSI: 0000000000000000 RDI: ffffffff82afb980 RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246 R13: ffff888109a20340 R14: ffff88885f95f420 R15: ffff88885f95f400 FS: 0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2163102430 CR3: 00000001128d6001 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x1a2/0x390 ? asm_exc_general_protection+0x22/0x30 ? __xfrm_state_delete+0x3d/0x1b0 ? __xfrm_state_delete+0x2f/0x1b0 xfrm_timer_handler+0x174/0x350 ? __xfrm_state_delete+0x1b0/0x1b0 __hrtimer_run_queues+0x121/0x270 hrtimer_run_softirq+0x88/0xd0 handle_softirqs+0xcc/0x270 do_softirq+0x3c/0x50 </IRQ> <TASK> __local_bh_enable_ip+0x47/0x50 mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core] process_one_work+0x137/0x2d0 worker_thread+0x28d/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1019-raspiUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-raspiUpgrade linux-image-6.8.0-54-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1024-gcp-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1020-oracleUpgrade linux-image-oem-22.04cUpgrade linux-image-aws-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-57-genericUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-azureUpgrade linux-image-gcp-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-54-lowlatencyUpgrade linux-image-6.8.0-1023-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.8.0-1022-nvidia-64kUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-realtimeUpgrade linux-image-gcpUpgrade linux-image-nvidia-64kUpgrade linux-image-kvmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-6.8.0-1019-gkeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1022-nvidia-lowlatency-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-6.8.0-1024-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-54-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-virtualUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-6.8.0-54-genericUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-oem-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1006-gkeopUpgrade linux-image-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1020-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidiaUpgrade linux-image-oem-24.04bUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-6.8.0-1025-azureUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.8.0-1022-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1022-nvidia-lowlatencyUpgrade linux-image-generic | Feb 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub