CVE-2025-21751
HighCVSS 7.8Summary
In the Linux kernel, a use-after-free vulnerability was fixed in the net/mlx5 (HWS) driver that occurs when a firmware failure happens during matcher disconnect. The error flow reconnected the matcher and returned an error, leading to the matcher being freed while still on the matchers list, resulting in use-after-free and eventual crash. The fix avoids reconnecting the matcher when a firmware command fails during disconnect.
Risk Assessment
The vulnerability can lead to kernel crashes and denial of service (DoS) on systems with Mellanox mlx5 cards. It may also cause resource leaks and incorrect network steering state.
Recommendation
Update the Linux kernel to a version containing the fix. Monitor systems with mlx5 cards for unexpected reboots or driver errors.
Other vulnerabilities in Linux kernel
See all- CVE-2026-58942High
In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58847Unknown
In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- CVE-2026-58829High
In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58828High
In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58827High
In multiple functions of dma-buf.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58826High
In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-58825High
In multiple functions of fork.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed.
- CVE-2026-99242Unknown
In the Linux kernel, a race between fallocate and mmap reads in NTFS was fixed. Fallocate only took invalidate_lock for punch hole, collapse range and insert range operations, and during standard allocation new clusters were mapped before being zeroed, allowing concurrent mmap page faults to read uninitialized disk data.
- CVE-2026-99241Unknown
In the Linux kernel, a missing lock in ntfs_filemap_page_mkwrite() was fixed; it called iomap_page_mkwrite() without holding mapping->invalidate_lock. A concurrent truncate or fallocate could be invalidating pagecache and rewriting the runlist while the write fault mapped blocks and dirtied the folio.
- CVE-2026-99240Unknown
In the Linux kernel, the DAMON subsystem (mm/damon/core) has a division-by-zero bug when a DAMOS quota goal has a target_value of zero. The fix moves handling of this corner case to the core layer by adding validation in damos_commit_quota_goal(), which now returns an error for zero target values.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow of the function reconnects the matcher back and returns an error, which continues running the calling function and eventually frees the matcher that is being disconnected. This leads to a case where we have a freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case with any other error handling during resource destruction. However, the goal here is to allow the driver to continue and not crash the machine with use-after-free error.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS