CVE-2025-40238

Mellanox ConnectX drivers encounter a race during network device detachment where IPsec MPV events continue arriving after the netdev becomes invalid. The mlx5e_detach_netdev() path disables event handlers too late, allowing mlx5_devcom_comp_set_ready() to dereference a stale pointer. Proper ordering requires devcom unregistration before blocking event handlers are disabled.

This race condition affects systems running Mellanox ConnectX NICs with eswitch mode changes while IPsec is configured. The window for exploitation is narrow, requiring precise timing during administrative operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.