CVE-2025-39830: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39830 is a memory leak vulnerability in the Linux kernel's MLX5 Hardware Steering (HWS) component, specifically in the hws_pool_buddy_init() function. The error path of this function fails to call kfree() on the buddy allocator structure, resulting in unreleased kernel memory. It affects Linux kernel versions from 6.12 up to (but not including) 6.16.5, as well as release candidates 6.17-rc1, 6.17-rc2, and 6.17-rc3. Disclosed on September 16, 2025, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the hws_pool_buddy_init() function within the net/mlx5 driver's hardware steering subsystem, when initialization fails and the error path is taken, the cleanup routine invokes buddy allocator teardown logic but omits a kfree() call on the allocator structure itself. This results in a kernel memory leak each time the error path is triggered. The fix adds the missing kfree() call to ensure all allocated memory is properly released (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2). Exploitation requires local access with low privileges (no root required), and no user interaction is needed.

Successful exploitation by a low-privileged local attacker could cause gradual kernel memory exhaustion in systems using Mellanox/NVIDIA MLX5 network adapters with hardware steering enabled. Over time, this resource depletion can lead to system performance degradation or a denial-of-service condition. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Update to Linux kernel version 6.16.5 or later, which incorporates the fix via the addition of the missing kfree() call in the hws_pool_buddy_init() error path. The upstream patches are available at the stable kernel repository (commits 2c0a959bebdc and 86d13a6f49cb). As a compensating control, administrators should monitor system memory usage for unexplained kernel memory growth, restrict local system access to minimize exposure, and apply vendor-provided kernel updates from distributions such as Red Hat as they become available (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).