CVE-2025-39979 is a use-after-free vulnerability in the Linux kernel's mlx5 driver related to flow counter release. The kernel trace shows that when deleting a hardware steering (HWS) action of a local flow counter in mlx5_cmd_hws_delete_fte(), the reference count and mutex were not properly initialized. This could cause the local flow counter structure to be freed prematurely, leading to a use-after-free condition. The fix involved adding the missing initializations and reference counting to the local flow counter struct to prevent premature freeing and ensure safe deletion of flow rules.

The vulnerability allows a use-after-free condition in the kernel, which can cause system instability, crashes, or potentially allow an attacker with limited privileges to escalate their privileges or execute arbitrary code in kernel context. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel by adding missing initializations and reference counting in the mlx5 driver code. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel mailing lists or official repositories for the specific patch and update guidance.