In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twice
The km.state is not checked in driver's delayed work. When xfrm_state_check_expire() is called, the state can be reset to XFRM_STATE_EXPIRED, even if it is XFRM_STATE_DEAD already. This happens when xfrm state is deleted, but not freed yet. As __xfrm_state_delete() is called again in xfrm timer, the following crash occurs.
To fix this issue, skip xfrm_state_check_expire() if km.state is not XFRM_STATE_VALID.
Oops: general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP CPU: 5 UID: 0 PID: 7448 Comm: kworker/u102:2 Not tainted 6.11.0-rc2+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e_ipsec: eth%d mlx5e_ipsec_handle_sw_limits [mlx5_core] RIP: 0010:__xfrm_state_delete+0x3d/0x1b0 Code: 0f 84 8b 01 00 00 48 89 fd c6 87 c8 00 00 00 05 48 8d bb 40 10 00 00 e8 11 04 1a 00 48 8b 95 b8 00 00 00 48 8b 85 c0 00 00 00 <48> 89 42 08 48 89 10 48 8b 55 10 48 b8 00 01 00 00 00 00 ad de 48 RSP: 0018:ffff88885f945ec8 EFLAGS: 00010246 RAX: dead000000000122 RBX: ffffffff82afa940 RCX: 0000000000000036 RDX: dead000000000100 RSI: 0000000000000000 RDI: ffffffff82afb980 RBP: ffff888109a20340 R08: ffff88885f945ea0 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88885f945ff8 R12: 0000000000000246 R13: ffff888109a20340 R14: ffff88885f95f420 R15: ffff88885f95f400 FS: 0000000000000000(0000) GS:ffff88885f940000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2163102430 CR3: 00000001128d6001 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x1a2/0x390 ? asm_exc_general_protection+0x22/0x30 ? __xfrm_state_delete+0x3d/0x1b0 ? __xfrm_state_delete+0x2f/0x1b0 xfrm_timer_handler+0x174/0x350 ? __xfrm_state_delete+0x1b0/0x1b0 __hrtimer_run_queues+0x121/0x270 hrtimer_run_softirq+0x88/0xd0 handle_softirqs+0xcc/0x270 do_softirq+0x3c/0x50 </IRQ> <TASK> __local_bh_enable_ip+0x47/0x50 mlx5e_ipsec_handle_sw_limits+0x7d/0x90 [mlx5_core] process_one_work+0x137/0x2d0 worker_thread+0x28d/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1022-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-6.8.0-54-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1024-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1019-gkeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.8.0-1022-nvidia-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1024-oemUpgrade linux-image-6.8.0-54-lowlatencyUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1024-gcp-64kUpgrade linux-image-awsUpgrade linux-image-azure-fdeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1023-awsUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-azureUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1019-raspiUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1020-oracleUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1022-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-nvidiaUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1025-azureUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-24.04bUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-54-generic-64kUpgrade linux-image-virtualUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-6.8.0-1022-nvidia-lowlatencyUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-genericUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1020-oracle-64kUpgrade linux-image-6.8.0-54-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1006-gkeopUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-ibmUpgrade linux-image-generic-64kUpgrade linux-image-ibm-classic | Feb 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub