NVIDIA BlueField (mlx5 ECVF): Use-after-free during ECVF vport unload in the mlx5 driver
CVSS 7.8CVE-2025-38109NVIDIA / GPU stackcurated
Impact
Use-after-free during ECVF vport unload in the mlx5 driver — kernel-level memory corruption on the host attached to the DPU
Who can reach it
Local, host kernel
What to do
Host kernel update plus driver refresh; requires a node drain because the mlx5 driver carries the tenant's data path
References
Related entries
- Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535): Nouveau's GSP RPC layer frees the caller's messageCVE-2025-38187 · Linux kernel (drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): A NULL pointer dereference in the amdgpu display coreCVE-2025-38361 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdgpu): A use-after-free in the amdkfd (KFD compute driverCVE-2025-38598 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdgpu)High
- habanalabs kernel driver (dma-buf export path): A use-after-free in the habanalabs dma-buf export path: the driverCVE-2025-38722 · habanalabs kernel driver (dma-buf export path)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): A NULL pointer dereference in the amdgpu display coreCVE-2025-39906 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): A NULL pointer dereference in the amdgpu display coreCVE-2025-40354 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.