CVE-2025-21717 is a vulnerability identified in the Linux kernel, specifically affecting the Mellanox mlx5 Ethernet driver component (mlx5e). The issue arises from a missing conversion of CPU IDs to NUMA node IDs when allocating memory with kvzalloc_node in the mlx5e_open_xdpredirect_sq function. The Linux kernel function kvzalloc_node is used to allocate memory on a specific NUMA node, but it does not perform runtime validation of the node argument. In non-debug kernel builds, this lack of validation can lead to out-of-bounds (OOB) memory access if the CPU ID passed exceeds the maximum number of NUMA nodes (MAX_NUMNODES). This OOB access results in a kernel panic and system crash, as demonstrated by the provided kernel trace showing a page fault triggered during ethtool or netlink operations that invoke mlx5e_open on an invalid CPU ID. The root cause is the absence of the cpu_to_node conversion, which should translate a CPU identifier to its corresponding NUMA node identifier before memory allocation. This vulnerability can be triggered by performing network interface operations that cause mlx5e_open to be called on a CPU ID outside the valid range, leading to a denial of service (DoS) via kernel panic. The vulnerability affects Linux kernel versions containing the specified commit hashes and is resolved by adding the missing cpu_to_node call. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability impacts system stability and availability but does not appear to allow privilege escalation or code execution directly.

For European organizations relying on Linux servers with Mellanox mlx5 network adapters, this vulnerability poses a risk of denial of service due to kernel panics triggered by certain network management operations. This can disrupt critical network services, especially in data centers, cloud infrastructure, and high-performance computing environments where Mellanox hardware is prevalent. The impact is primarily on availability, potentially causing unexpected system reboots and service interruptions. Organizations with NUMA architectures and multi-CPU systems are more susceptible, as the vulnerability is triggered by CPU IDs exceeding the maximum NUMA nodes. While no direct confidentiality or integrity compromise is indicated, the operational disruption could affect business continuity, service level agreements, and incident response efforts. Given the widespread use of Linux in European enterprise and public sector infrastructure, unpatched systems could face increased downtime and operational risk until remediation is applied.

1. Apply the official Linux kernel patch that adds the missing cpu_to_node conversion in the mlx5e driver to ensure proper NUMA node validation during memory allocation. 2. Upgrade to the latest stable Linux kernel version that includes this fix as soon as it becomes available from your Linux distribution vendor. 3. In environments where immediate patching is not feasible, restrict or carefully control the use of ethtool and netlink operations that could trigger mlx5e_open calls, especially on systems with Mellanox mlx5 hardware. 4. Monitor kernel logs for signs of page faults or kernel panics related to mlx5e to detect potential triggering of this vulnerability. 5. Conduct thorough testing of network management scripts and automation tools that interact with Mellanox network interfaces to avoid inadvertent triggering of the vulnerability. 6. Coordinate with hardware and software vendors to ensure firmware and driver compatibility with patched kernels. 7. Implement robust system monitoring and automated recovery mechanisms to minimize downtime in case of unexpected kernel panics.