Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-68816

net/mlx5: fw_tracer, Validate format string parameters

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in 95624b731c490a4b849844269193a233d6d556a0; From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in 768d559f466cdd72849110a7ecd76a21d52dcfe3; From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in 38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d; From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in 8ac688c0e430dab19f6a9b70df94b1f635612c1a; From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in 45bd283b1d69e2c97cddcb9956f0e0261fc4efd7; From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in 8c35c2448086870509ede43947845be0833251f0; From 70dd6fdb8987b14f7b6105f6be0617299e459398 · fixed in b35966042d20b14e2d83330049f77deec5229749

  • Linux Linux

    4.19

  • KernelLinux

    From 4.19.0 · fixed in 5.10.248; From 5.11.0 · fixed in 5.15.198; From 5.16.0 · fixed in 6.1.160; From 6.2.0 · fixed in 6.6.120; From 6.7.0 · fixed in 6.12.64; From 6.13.0 · fixed in 6.18.3

References 7

git.kernel.org