PT-2026-2548 · Unknown+3 · Mlx5 Firmware+3
Published
2026-01-13
·
Updated
2026-05-11
·
CVE-2025-68816
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel’s networking subsystem, specifically the mlx5 firmware tracer, contained a flaw where format string parameters were not properly validated. This allowed potentially malicious firmware to supply format strings with unsafe specifiers (like %s, %p, or %n). These unsafe format strings could lead to crashes or other unpredictable behavior. A function,
mlx5 tracer validate params(), was added to validate format specifiers, limiting them to safe integer/hex formats such as %x, %d, %i, %u, %llx, %lx, and so on. Invalid format strings are now flagged in trace output with a "BAD FORMAT: " prefix.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu
Mlx5 Firmware