CVE-2025-38020: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38020 is a NULL pointer dereference vulnerability in the Linux kernel's net/mlx5e driver, specifically in the handling of MACsec offload for uplink representor profiles. When a system switches to the uplink representor profile in switchdev mode, the MACsec offload feature bit (NETIF_F_HW_MACSEC) is not cleared from the netdevice's features, even though uplink representors do not support MACsec offload. Subsequent attempts to add MACsec offloads trigger a null pointer dereference (general protection fault), as observed in kernel log output showing a KASAN null-ptr-deref. The vulnerability affects Linux kernel versions 6.1.x before 6.1.140, 6.2.x–6.6.x before 6.6.92, 6.7.x–6.12.x before 6.12.30, and 6.13.x before 6.14.8, as well as Debian Linux 11.0. It was published on June 18, 2025, with a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When the MLX5 driver transitions a network device to the uplink representor profile (switchdev mode), the function mlx5e_fix_uplink_rep_features() fails to clear the NETIF_F_HW_MACSEC feature flag. Because uplink representors lack the internal data structures required for MACsec offload, any subsequent call to add a MACsec offload dereferences a null pointer — specifically accessing an address in the range [0x0000000000000078–0x000000000000007f] — causing a general protection fault. The attack vector is local, requiring low privileges and no user interaction, as a local user with sufficient permissions to manipulate network device features (e.g., via the ip command) can trigger the crash. The fix involves explicitly clearing NETIF_F_HW_MACSEC in mlx5e_fix_uplink_rep_features() (Feedly, Kernel Patch).

Successful exploitation causes a kernel panic (general protection fault / KASAN null-ptr-deref), resulting in a system crash and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. Systems using Mellanox/NVIDIA MLX5-based network adapters operating in switchdev mode are at risk, and a crash could disrupt all services running on the affected host (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges on a system using an MLX5 NIC in switchdev mode, limiting the practical attack surface (Feedly).

The Linux kernel stable repositories have released patches addressing this issue across all affected branches: kernel 6.1.140+, 6.6.92+, 6.12.30+, and 6.14.8+. Downstream distributions including SUSE, Debian (LTS DLA-4271-1 for linux 6.1), Ubuntu (USN-7699-1, USN-7699-2, USN-7721-1), and Oracle Linux have issued updated kernel packages. Administrators should update to the patched kernel version for their distribution as the primary remediation. As a workaround, avoid switching MLX5 devices to switchdev/uplink representor mode on unpatched kernels, or disable MACsec offload manually before performing the profile switch (Feedly, Debian LTS, Ubuntu USN-7699-1).