LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40350: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ XDP programs can change the layout of an xdp_buff through bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver cannot assume the size of the linear data area nor fragments. Fix the bug in mlx5 by generating skb according to xdp_buff after XDP programs run. Currently, when handling multi-buf XDP, the mlx5 driver assumes the layout of an xdp_buff to be unchanged. That is, the linear data area continues to be empty and fragments remain the same. This may cause the driver to generate erroneous skb or triggering a kernel warning. When an XDP program added linear data through bpf_xdp_adjust_head(), the linear data will be ignored as mlx5e_build_linear_skb() builds an skb without linear data and then pull data from fragments to fill the linear data area. When an XDP program has shrunk the non-linear data through bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() may exceed the actual nonlinear data size and trigger the BUG_ON in it. To fix the issue, first record the original number of fragments. If the number of fragments changes after the XDP program runs, rewind the end fragment pointer by the difference and recalculate the truesize. Then, build the skb with the linear data area matching the xdp_buff. Finally, only pull data in if there is non-linear data and fill the linear part up to 256 bytes.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the mlx5e network driver when XDP programs modify packet buffer layout. Under specific receive-path conditions, the driver can build an invalid network buffer or hit a kernel BUG warning. Business urgency is highest for Linux systems using Mellanox/NVIDIA mlx5 networking with XDP enabled.

Executive priority

Treat as a targeted infrastructure reliability issue. Patch on normal-to-expedited kernel maintenance cycles, with higher priority for high-throughput Linux hosts using mlx5e and XDP. No public exploitation evidence is provided, but affected production networking nodes could experience disruptive kernel failures.

Technical view

The mlx5e RX path for striding RQ assumed a non-linear xdp_buff layout remained unchanged after XDP execution. bpf_xdp_adjust_head() or bpf_xdp_adjust_tail() can invalidate those assumptions, causing erroneous skb generation or a BUG_ON during tail pulling. Stable kernel commits adjust skb construction to match the post-XDP xdp_buff layout.

Likely exposure

Exposure appears limited to Linux kernels using the mlx5e driver, striding receive queues, multi-buffer XDP, and XDP programs that adjust head or tail. The source lists affected Linux versions and stable fix commits but does not provide a CVSS score or distribution-specific package status.

Exploitation context

The provided sources do not report active exploitation, and this CVE is not marked KEV. Triggering depends on specific driver, XDP, and packet-buffer conditions. The likely impact is reliability or availability risk through kernel warning or BUG_ON, not a documented remote code execution path.

Researcher notes

Evidence is limited to the CVE description and Linux stable references. No CVSS, CWE, exploit status, or distro advisory is included. The root cause is a stale xdp_buff layout assumption after XDP helper calls, corrected by rebuilding skb state from the modified buffer layout.

Mitigation direction

  • Apply a Linux kernel update containing the referenced stable mlx5e fix commits.
  • Check distribution advisories for backported fixes and exact package versions.
  • Prioritize systems using mlx5e networking and XDP programs that adjust packet buffers.
  • If immediate patching is not possible, seek vendor guidance for safe interim controls.

Validation and detection

  • Inventory Linux systems using Mellanox/NVIDIA mlx5e network interfaces.
  • Identify hosts running XDP programs on mlx5e interfaces.
  • Review whether XDP programs adjust packet head or tail.
  • Verify the running kernel includes the relevant stable fix or vendor backport.
  • Monitor affected hosts for kernel warnings or crashes in the mlx5e RX path.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40350 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf52ac7028bec22e925c8fece4f21641eb13b4d6f, f52ac7028bec22e925c8fece4f21641eb13b4d6f, f52ac7028bec22e925c8fece4f21641eb13b4d6f, f52ac7028bec22e925c8fece4f21641eb13b4d6funaffected
LinuxLinux6.4, 0, 6.6.115, 6.12.56, 6.17.6, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.