net/mlx5: Bridge, fix the crash caused by LAG state check
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Bridge, fix the crash caused by LAG state check When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the offloaded entries. And mlx5_lag_is_shared_fdb is checked, it returns false if one of PF is unloaded. In such case, mlx5_esw_bridge_lag_rep_get() and its caller return NULL, instead of the alive PF, and the flush is skipped. Besides, the bridge fdb entry's lastuse is updated in mlx5 bridge event handler. But this SWITCHDEV_FDB_ADD_TO_BRIDGE event can be ignored in this case because the upper interface for bond is deleted, and the entry will never be aged because lastuse is never updated. To make things worse, as the entry is alive, mlx5 bridge workqueue keeps sending that event, which is then handled by kernel bridge notifier. It causes the following crash when accessing the passed bond netdev which is already destroyed. To fix this issue, remove such checks. LAG state is already checked in commit 15f8f168952f ("net/mlx5: Bridge, verify LAG state when adding bond to bridge"), driver still need to skip offload if LAG becomes invalid state after initialization. Oops: stack segment: 0000 [#1] SMP CPU: 3 UID: 0 PID: 23695 Comm: kworker/u40:3 Tainted: G OE 6.11.0_mlnx #1 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Wor
CVE-2025-21970
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-21970
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ff9b7521468bc2909293c1cda66a245a49688f6f",
"lessThan": "f90c4d6572488e2bad38cca00f1c59174a538a1a",
"versionType": "git"
},
{
"status": "affected",
"version": "ff9b7521468bc2909293c1cda66a245a49688f6f",
"lessThan": "86ff45f5f61ae1d0d17f0f6d8797b052eacfd8f1",
"versionType": "git"
},
{
"status": "affected",
"version": "ff9b7521468bc2909293c1cda66a245a49688f6f",
"lessThan": "bd7e3a42800743a7748c83243e4cafc1b995d4c4",
"versionType": "git"
},
{
"status": "affected",
"version": "ff9b7521468bc2909293c1cda66a245a49688f6f",
"lessThan": "f7bf259a04271165ae667ad21cfc60c6413f25ca",
"versionType": "git"
},
{
"status": "affected",
"version": "ff9b7521468bc2909293c1cda66a245a49688f6f",
"lessThan": "5dd8bf6ab1d6db40f5d09603759fa88caec19e7f",
"versionType": "git"
},
{
"status": "affected",
"version": "ff9b7521468bc2909293c1cda66a245a49688f6f",
"lessThan": "4b8eeed4fb105770ce6dc84a2c6ef953c7b71cbb",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.15.180",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.132",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.84",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.20",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.13.8",
"versionType": "semver",
"lessThanOrEqual": "6.13.*"
},
{
"status": "unaffected",
"version": "6.14",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-21970
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30449 · Revision 1
- Added to Heist Feed
- Publisher date