CVE-2025-68209: mlx5: Fix default values in create CQ

Published Dec 16, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

mlx5: Fix default values in create CQ

Currently, CQs without a completion function are assigned the mlx5addcqtotasklet function by default. This is problematic since only user CQs created through the mlx5ib driver are intended to use this function.

Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5cqarm. However, the default CQ creation flow leaves a valid value in the CQ's armdb field, allowing FW to send interrupts to polling-only CQs in certain corner cases.

These two factors would allow a polling-only kernel CQ to be triggered by an EQ interrupt and call a completion function intended only for user CQs, causing a null pointer exception.

Some areas in the driver have prevented this issue with one-off fixes but did not address the root cause.

This patch fixes the described issue by adding defaults to the create CQ flow. It adds a default dummy completion function to protect against null pointer exceptions, and it sets an invalid command sequence number by default in kernel CQs to prevent the FW from sending an interrupt to the CQ until it is armed. User CQs are responsible for their own initialization values.

Callers of mlx5corecreatecq are responsible for changing the completion function and arming the CQ per their needs.

Affected Software

2 affected components
linux_kernel
Microsoft azl3 kernel 6.6.117.1-1

Event History

Dec 16, 2025
CVE Published
via MITRE·01:48 PM
Data Sourced
via MITRE·01:48 PM
Description
Data Sourced
via NVD·02:15 PM
Description
Dec 17, 2025
Data Sourced
via Microsoft·01:04 AM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-68209?

CVE-2025-68209 is considered a medium severity vulnerability due to the potential impact on the completion functions in the Linux kernel.

2

How do I fix CVE-2025-68209?

To fix CVE-2025-68209, update to the latest patched version of the Linux kernel where this vulnerability has been resolved.

3

What are the potential impacts of CVE-2025-68209?

The potential impacts of CVE-2025-68209 include improper handling of completion functions in completion queues, which could lead to system instability.

4

Who is affected by CVE-2025-68209?

CVE-2025-68209 affects users of the Linux kernel that utilize mlx5 for managing completion queues.

5

What components are involved in CVE-2025-68209?

CVE-2025-68209 involves the mlx5 driver in the Linux kernel and specifically concerns the configuration of completion queues.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203