CVE-2025-40350: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40350 is a kernel bug in the Linux kernel's mlx5e (Mellanox/NVIDIA ConnectX) network driver affecting the RX path for striding receive queues (RQ) when processing non-linear XDP buffers. The vulnerability arises because the driver incorrectly assumes the layout of an xdp_buff is unchanged after an XDP program runs, which can lead to erroneous socket buffer (skb) generation or a kernel BUG_ON panic. It was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. The EPSS score is approximately 0.018% (very low), and no CVSS score has been formally assigned at this time (Feedly).

The root cause is improper handling of xdp_buff layout changes made by XDP programs via bpf_xdp_adjust_tail() and bpf_xdp_adjust_head() in the mlx5e striding RQ path (CWE-20: Improper Input Validation). When an XDP program adds linear data via bpf_xdp_adjust_head(), the driver's mlx5e_build_linear_skb() ignores it and builds an skb without linear data, then incorrectly pulls from fragments. When an XDP program shrinks non-linear data via bpf_xdp_adjust_tail(), the delta passed to __pskb_pull_tail() can exceed the actual non-linear data size, triggering a BUG_ON assertion in the kernel. The fix records the original fragment count before the XDP program runs, rewinds the end fragment pointer by the difference if fragments change, recalculates truesize, and builds the skb to match the actual post-XDP xdp_buff layout (Feedly).

Successful triggering of this vulnerability can cause a kernel panic (BUG_ON) on systems using Mellanox/NVIDIA mlx5e NICs with XDP programs loaded on striding RQs, resulting in a denial of service (system crash). Additionally, incorrect skb construction could lead to memory corruption or data integrity issues in network packet processing. The impact is limited to systems with mlx5e hardware and active XDP programs that modify buffer layout; it is not remotely exploitable without local or privileged access to load BPF/XDP programs (Feedly).

Apply the upstream Linux kernel patches that fix the mlx5e striding RQ skb generation logic. The fixes are available in the stable kernel git tree at commits 8b051d7f530e, 87bcef158ac1, cb9edd583e23, and f2557d7fa38e. Distributions including SUSE (SUSE-2026-0447) and Red Hat have issued or are tracking advisories for this CVE; users should apply the relevant vendor kernel updates as they become available. As a temporary workaround, disabling XDP programs on mlx5e interfaces using striding RQs will prevent the vulnerable code path from being triggered (Feedly).