CVE-2025-68209

A null pointer dereference was found in the Mellanox mlx5 driver in the Linux kernel. Default CQ creation assigns an inappropriate completion function and leaves valid arm_db values for polling-only CQs. This allows firmware to trigger interrupts on polling CQs, causing null pointer dereferences when the wrong completion handler runs.

Systems with Mellanox ConnectX-4 and newer network adapters are affected. The issue requires specific CQ usage patterns to trigger. The fix adds proper defaults and dummy completion handlers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.