Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by… (CVE-2025-39979)
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not initialized and the counter struct could already be freed when deleting the rule. Fix it by adding the missing initializations and adding refcount for the local flow counter struct. [1] Kernel log: Call Trace: <TASK> dump_stack_lvl+0x34/0x48 mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core] mlx5_fc_put_hws_action+0x96/0xad [mlx5_core] mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core] mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core] del_hw_fte+0x1ce/0x260 [mlx5_core] mlx5_del_flow_rules+0x12d/0x240 [mlx5_core] ? ttwu_queue_wakelist+0xf4/0x110 mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib] uverbs_free_flow+0x20/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs] uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs] uobj_destroy+0x3c/0x80 [ib_uverbs] ib_uverbs_run_method+0x23e/0x360 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs] ? do_tty_write+0x1a9/0x270 ? file_tty_write.constprop.0+0x98/0xc0 ? new_sync_write+0xfc/0x190 ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs] __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x59/0x90
AI Analysis
Technical Summary
CVE-2025-39979 is a use-after-free vulnerability in the Linux kernel's mlx5 driver related to flow counter release. The kernel trace shows that when deleting a hardware steering (HWS) action of a local flow counter in mlx5_cmd_hws_delete_fte(), the reference count and mutex were not properly initialized. This could cause the local flow counter structure to be freed prematurely, leading to a use-after-free condition. The fix involved adding the missing initializations and reference counting to the local flow counter struct to prevent premature freeing and ensure safe deletion of flow rules.
Potential Impact
The vulnerability allows a use-after-free condition in the kernel, which can cause system instability, crashes, or potentially allow an attacker with limited privileges to escalate their privileges or execute arbitrary code in kernel context. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by adding missing initializations and reference counting in the mlx5 driver code. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel mailing lists or official repositories for the specific patch and update guidance.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by… (CVE-2025-39979)
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not initialized and the counter struct could already be freed when deleting the rule. Fix it by adding the missing initializations and adding refcount for the local flow counter struct. [1] Kernel log: Call Trace: <TASK> dump_stack_lvl+0x34/0x48 mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core] mlx5_fc_put_hws_action+0x96/0xad [mlx5_core] mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core] mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core] del_hw_fte+0x1ce/0x260 [mlx5_core] mlx5_del_flow_rules+0x12d/0x240 [mlx5_core] ? ttwu_queue_wakelist+0xf4/0x110 mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib] uverbs_free_flow+0x20/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs] uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs] uobj_destroy+0x3c/0x80 [ib_uverbs] ib_uverbs_run_method+0x23e/0x360 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs] ? do_tty_write+0x1a9/0x270 ? file_tty_write.constprop.0+0x98/0xc0 ? new_sync_write+0xfc/0x190 ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs] __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x59/0x90
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-39979 is a use-after-free vulnerability in the Linux kernel's mlx5 driver related to flow counter release. The kernel trace shows that when deleting a hardware steering (HWS) action of a local flow counter in mlx5_cmd_hws_delete_fte(), the reference count and mutex were not properly initialized. This could cause the local flow counter structure to be freed prematurely, leading to a use-after-free condition. The fix involved adding the missing initializations and reference counting to the local flow counter struct to prevent premature freeing and ensure safe deletion of flow rules.
Potential Impact
The vulnerability allows a use-after-free condition in the kernel, which can cause system instability, crashes, or potentially allow an attacker with limited privileges to escalate their privileges or execute arbitrary code in kernel context. The CVSS 3.1 vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel by adding missing initializations and reference counting in the mlx5 driver code. Users should apply the official Linux kernel updates that include this patch once available. Patch status is not yet confirmed from the vendor advisory; check the Linux kernel mailing lists or official repositories for the specific patch and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-52rq-cpwv-rvvm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-39979"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d89c2644c7f847be3b
Added to database: 07/30/2026, 15:50:48 UTC
Last enriched: 07/30/2026, 15:52:40 UTC
Last updated: 09/12/2026, 10:01:28 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.