CVE-2025-38020: net/mlx5e: Disable MACsec offload for uplink representor profile
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Disable MACsec offload for uplink representor profile
MACsec offload is not supported in switchdev mode for uplink representors. When switching to the uplink representor profile, the MACsec offload feature must be cleared from the netdevice's features.
If left enabled, attempts to add offloads result in a null pointer dereference, as the uplink representor does not support MACsec offload even though the feature bit remains set.
Clear NETIFFHWMACSEC in mlx5efixuplinkrepfeatures().
Kernel log:
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 29 UID: 0 PID: 4714 Comm: ip Not tainted 6.14.0-rc4forupstreamdebug202503021735 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:mutexlock+0x128/0x1dd0 Code: d0 7c 08 84 d2 0f 85 ad 15 00 00 8b 35 91 5c fe 03 85 f6 75 29 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a6 15 00 00 4d 3b 76 60 0f 85 fd 0b 00 00 65 ff RSP: 0018:ffff888147a4f160 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000078 RBP: ffff888147a4f2e0 R08: ffffffffa05d2c19 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000018 R15: ffff888152de0000 FS: 00007f855e27d800(0000) GS:ffff88881ee80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004e5768 CR3: 000000013ae7c005 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 Call Trace: <TASK> ? dieaddr+0x3d/0xa0 ? excgeneralprotection+0x144/0x220 ? asmexcgeneralprotection+0x22/0x30 ? mlx5emacsecaddsecy+0xf9/0x700 [mlx5core] ? mutexlock+0x128/0x1dd0 ? lockdepsetlockcmpfn+0x190/0x190 ? mlx5emacsecaddsecy+0xf9/0x700 [mlx5core] ? mutexlockionested+0x1ae0/0x1ae0 ? lockacquire+0x1c2/0x530 ? macsecupdoffload+0x145/0x380 ? lockdephardirqsonprepare+0x400/0x400 ? kasansavestack+0x30/0x40 ? kasansavestack+0x20/0x40 ? kasansavetrack+0x10/0x30 ? kasankmalloc+0x77/0x90 ? kmallocnoprof+0x249/0x6b0 ? genlfamilyrcvmsgattrsparse.constprop.0+0xb5/0x240 ? mlx5emacsecaddsecy+0xf9/0x700 [mlx5core] mlx5emacsecaddsecy+0xf9/0x700 [mlx5core] ? mlx5emacsecaddrxsa+0x11a0/0x11a0 [mlx5core] macsecupdateoffload+0x26c/0x820 ? macsecsetmacaddress+0x4b0/0x4b0 ? lockdephardirqsonprepare+0x284/0x400 ? rawspinunlockirqrestore+0x47/0x50 macsecupdoffload+0x2c8/0x380 ? macsecupdateoffload+0x820/0x820 ? nlaparse+0x22/0x30 ? genlfamilyrcvmsgattrsparse.constprop.0+0x15e/0x240 genlfamilyrcvmsgdoit+0x1cc/0x2a0 ? genlfamilyrcvmsgattrsparse.constprop.0+0x240/0x240 ? capcapable+0xd4/0x330 genlrcvmsg+0x3ea/0x670 ? genlfamilyrcvmsgdumpit+0x2a0/0x2a0 ? lockdepsetlockcmpfn+0x190/0x190 ? macsecupdateoffload+0x820/0x820 netlinkrcvskb+0x12b/0x390 ? genlfamilyrcvmsgdumpit+0x2a0/0x2a0 ? netlinkack+0xd80/0xd80 ? rwsemdownreadslowpath+0xf90/0xf90 ? netlinkdelivertap+0xcd/0xac0 ? netlinkdelivertap+0x155/0xac0 ? copyfromiter+0x1bb/0x12c0 genlrcv+0x24/0x40 netlinkunicast+0x440/0x700 ? netlinkattachskb+0x760/0x760 ? lockacquire+0x1c2/0x530 ? mightfault+0xbb/0x170 netlinksendmsg+0x749/0xc10 ? netlinkunicast+0x700/0x700 ? mightfault+0xbb/0x170 ? netlinkunicast+0x700/0x700 socksendmsg+0xc5/0x190 syssendmsg+0x53f/0x760 ? importiovec+0x7/0x10 ? kernelsendmsg+0x30/0x30 ? copymsghdr+0x3c0/0x3c0 ? filterirqstacks+0x90/0x90 ? stackdepotsaveflags+0x28/0xa30 syssen ---truncated---
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.140-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.30-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.140 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.92 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.30 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.14.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1 - Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.49~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1051.57~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.53~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1047.50~22.04.2 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1044.44~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1046.49~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1043.44~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-100.100~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1041.42~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-100.100 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1046.52 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1046.53 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1047.50 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1014.15~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1043.48 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1030.33 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1044.44 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-100.100.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1046.49 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1043.44 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1047.51 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-28.28.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1023.24 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1016.20 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2037.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1041.42 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1010.10~24.04.1 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.49+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1046.52+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-100.100+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1047.50+fips1 - Configuration
When switching to the uplink representor profile, clear NETIF_F_HW_MACSEC from the netdevice features to disable MACsec offload.
Linux kernel net/mlx5e uplink representor NETIF_F_HW_MACSEC = cleared
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38020?
CVE-2025-38020 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38020?
To fix CVE-2025-38020, update your Linux kernel to the latest stable version provided by The Linux Foundation.
What component does CVE-2025-38020 affect in the Linux kernel?
CVE-2025-38020 specifically affects the net/mlx5e component related to MACsec offload in uplink representors.
Is CVE-2025-38020 present in older versions of the Linux kernel?
Yes, CVE-2025-38020 is present in earlier versions of the Linux kernel prior to the release of the fix.
What is MACsec offload as it pertains to CVE-2025-38020?
In the context of CVE-2025-38020, MACsec offload is a feature that is not supported for uplink representors in switchdev mode.