CVE-2025-38590

A flaw was found in the Linux kernel's Mellanox network driver (mlx5). This vulnerability allows an attacker to cause a denial of service (DoS) by triggering a kernel crash. When the driver processes hardware-decrypted Internet Protocol Security (IPsec) packets whose security state has already been removed, it fails to clear the associated security metadata from the packet buffer. Subsequent network policy checks then dereference an invalid state pointer, resulting in a system crash.

This bug in the mlx5 IPsec receive offload path could trigger a kernel crash when hardware reported a decrypted packet with an already freed xfrm state. The driver failed to clear the secpath extension on the skb, leaving sp->len at zero, which later caused __xfrm_policy_check() to dereference an invalid state pointer. For the Red Hat Enterprise Linux (all versions) the Kernel config param CONFIG_MLX5_EN_MACSEC disabled, so this bug not actual (not affected).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module mlx5_core from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.