CVE-2025-40250

Error handling in mlx5_irq_alloc() destroys the entire CPU affinity rmap instead of just the failed mapping when request_irq() returns an error. Concurrent threads accessing the rmap trigger a general protection fault as they dereference freed memory. The crash signature shows free_irq_cpu_rmap() accessing corrupted pointers during IRQ vector exhaustion scenarios.

Mellanox NICs configured with both fwctl and RDS are particularly susceptible. IRQ vector exhaustion creates the error condition; high-density virtualized environments with many network-intensive workloads have elevated risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.