PT-2025-40643 · Linux +2 · Linux Kernel +2

Published 2025-10-04 · Updated 2025-10-07 · CVE-2025-39947

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The

mlx5 uplink netdev get()

function in the Linux kernel does not properly validate a netdevice pointer before use, potentially leading to a kernel panic when the device is unbound. Specifically, the function retrieves the uplink netdevice pointer from

mdev->mlx5e res.uplink netdev

, but this pointer can be cleared during device unbinding. This results in a NULL pointer dereference when the function attempts to access the invalid memory location. The call trace indicates the issue occurs within the

mlx5 core

module, specifically in the

mlx5e vport rep load

function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-39947

ECHO-69BE-CF4B-9922

Affected Products

Debian

Linux Kernel

Mlx5E

References · 20

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-39947 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-39947 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-39947 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/linux · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-39947 · Security Note
• https://ubuntu.com/security/CVE-2025-39947 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-39947 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-39947 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-39947 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-39947 · Vendor Advisory
• https://git.kernel.org/linus/6b4be64fd9fec16418f365c2d8e47a7566e9eba5 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5 · Note
• https://docs.bell-sw.com/security/cves/CVE-2025-39947 · Note
• https://git.kernel.org/stable/c/d1f3db4e7a3be29fc17f01850f162363f919370d · Note