CVE-2025-40250: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40250 is a Denial of Service vulnerability in the Linux kernel's mlx5 (Mellanox) network driver, where the mlx5_irq_alloc() function can inadvertently free the entire IRQ reverse mapping (rmap) when request_irq() fails due to exhausted IRQ vectors. This improper cleanup can cause a system crash when other threads attempt to access the freed mapping. The vulnerability was published on December 4, 2025, and affects Linux kernel versions used in systems with Mellanox network adapters, including Microsoft Azure Linux 3 kernel packages (azl3_kernel_6.6.112.1-2 and azl3_kernel_6.6.117.1-1). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, MSRC).

The root cause is improper resource cleanup (CWE-459: Incomplete Cleanup) in the mlx5_irq_alloc() function within the Linux kernel's mlx5 driver. When request_irq() fails — specifically due to exhausted IRQ vectors (error code -28, ENOSPC) — the function incorrectly frees the entire IRQ rmap rather than only the specific IRQ mapping that was just added. This leaves other valid IRQ mappings in an invalid state, and when concurrent threads attempt to access those freed mappings, a kernel crash results. The issue is specifically triggered when both fwctl and rds kernel configurations are enabled simultaneously, and exploitation requires low-privileged local access (Feedly). The fix modifies the cleanup logic to remove only the specific failed IRQ mapping's glue object, preserving all other valid mappings.

Successful exploitation results in a kernel crash, causing a Denial of Service (DoS) condition that disrupts system availability. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:H, C:N, I:N). Systems running Mellanox (MLX5) network adapters with both fwctl and rds configurations enabled are at risk, and a crash could affect all workloads running on the affected host, including containerized or virtualized environments (Feedly, MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface to authenticated users on affected systems (Feedly).

• Logs: Kernel log entries containing mlx5_irq_alloc:293:(pid XXXXX): Failed to request irq. err = -28 in dmesg or /var/log/kern.log; InfiniBand messages such as mlx5_ib_test_wc:290:(pid XXXXX): Error -28 while trying to test write-combining support.
• System Behavior: Unexpected kernel panics or system crashes on hosts running Mellanox (mlx5) network adapters; crash dump files (e.g., /var/crash/) generated around the time of IRQ exhaustion events.
• Process: Repeated registration and unregistration of panic handlers logged as Successfully registered/unregistered panic handler for port X from mlx5_core on multiple PCI devices in rapid succession.

The primary remediation is to update to a patched Linux kernel version that includes the fix modifying mlx5_irq_alloc() to clean up only the specific failed IRQ mapping. Patches are available via the Linux kernel stable tree (commits 4d6b4bea8b80, 6ebd02cf2dde, 69e043bce09c, d47515af6ccc) and have been incorporated into Ubuntu security notices USN-8094-1 through USN-8094-5 and USN-8152-1, as well as Oracle Linux and SUSE updates (Feedly, Ubuntu USN-8094-1). If immediate patching is not possible, consider limiting local user access, temporarily disabling fwctl and rds kernel configurations if not operationally required, and monitoring for unexpected kernel crashes (Feedly).