CVE-2025-38590: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38590 is a vulnerability discovered in the Linux kernel affecting the net/mlx5e subsystem. The issue was disclosed on August 19, 2025, and involves improper handling of skb secpath when xfrm state is not found. The vulnerability affects Linux kernel versions up to 6.15.0-rc7 (NVD).

The vulnerability occurs when hardware returns a unique identifier for a decrypted packet's xfrm state, which is looked up in an xarray. If the state is not found, only a counter is incremented while the secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0. Subsequently, functions like _xfrmpolicycheck() attempt to access fields such as xfrminput_state(skb)->xso.type without validating sp->len, leading to a crash when dereferencing an invalid state pointer (NVD).

The vulnerability can lead to a kernel crash (panic) when dereferencing an invalid state pointer, potentially causing system instability and denial of service conditions (NVD).

The vulnerability has been patched by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath. Updates are available for various Linux distributions including Ubuntu 24.04 LTS (linux 6.8.0-40.40) and Ubuntu 22.04 LTS (linux 5.15.0-121.131) (NVD).