CVE-2025-23259
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a...
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
CVE-2025-23259- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2025-26732
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
EUVD-2025-26732- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xq47-rgwp-c6c5
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a...
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
GHSA-xq47-rgwp-c6c5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
NVD
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
CVE-2025-23259- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Weakness
- CWE-362
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-23259
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
DEBIAN-CVE-2025-23259- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-23259
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
UBUNTU-CVE-2025-23259- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H - Updated
- 2026-11-02
Show 10 moreShow less
OSV No score
NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.
- Record
CVE-2025-23259- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20148-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
Update to version 24.11.4.
Security issues fixed:
- CVE-2025-23259: issue in the Poll Mode Driver (PMD) allows an attacker on a VM in the system to leak information and cause a denial of service on the network interface (bsc#1254161).
Other issues fixed:
- Remove obsolete build option -Denable_kmods.
- Add "which" as a build requirement.
- Drop pesign and needssslcertforbuild because we don't build a kmp anymore (bsc#1247389).
- Record
openSUSE-SU-2026:20148-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4254-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
- Update to version 22.11.10
- CVE-2025-23259: Fixed an out-of-order completions in ordinary Rx burst. (bsc#1254161)
- Record
SUSE-SU-2025:4254-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4534-1 No score
Security update for dpdk22
This update for dpdk22 fixes the following issues:
Update to version 22.11.10.
Security issues fixed:
- CVE-2025-23259: issue in the Poll Mode Driver (PMD) allows an attacker on a VM in the system to leak information and cause a denial of service on the network interface (bsc#1254161).
Other updates and bugfixes:
- Fix SUSE provided DPDK modules tainting the kernel as unsupported (bsc#1214724).
- Record
SUSE-SU-2025:4534-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0238-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
Update to version 24.11.4:
- CVE-2025-23259: Fixed an attacker on a VM in the system can cause information disclosure and denial of service (bsc#1254161).
Changelog:
https://doc.dpdk.org/guides-24.11/rel_notes/release_24_11.html#id10 https://doc.dpdk.org/guides-24.11/rel_notes/release_24_11.html#id5
- Record
SUSE-SU-2026:0238-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20036-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
Update to version 22.11.10.
Security issues fixed:
- CVE-2025-23259: issue in the Poll Mode Driver (PMD) allows an attacker on a VM in the system to leak information and cause a denial of service on the network interface (bsc#1254161).
Other updates and bugfixes:
- Fix SUSE provided DPDK modules tainting the kernel as unsupported (bsc#1214724).
Upstream release notes:
- Version 22.11.9 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id24
- Version 22.11.8 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id21
- Version 22.11.7 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id18
- Version 22.11.6 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id15
- Version 22.11.5 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id12
- Version 22.11.4 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id8
- Version 22.11.3 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id4
- Version 22.11.2 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id2
- Record
SUSE-SU-2026:20036-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20055-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
Update to version 22.11.10.
Security issues fixed:
- CVE-2025-23259: issue in the Poll Mode Driver (PMD) allows an attacker on a VM in the system to leak information and cause a denial of service on the network interface (bsc#1254161).
Other updates and bugfixes:
- Fix SUSE provided DPDK modules tainting the kernel as unsupported (bsc#1214724).
Upstream release notes:
- Version 22.11.9 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id24
- Version 22.11.8 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id21
- Version 22.11.7 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id18
- Version 22.11.6 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id15
- Version 22.11.5 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id12
- Version 22.11.4 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id8
- Version 22.11.3 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id4
- Version 22.11.2 https://doc.dpdk.org/guides-22.11/rel_notes/release_22_11.html#id2
- Record
SUSE-SU-2026:20055-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20209-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
Update to version 24.11.4.
Security issues fixed:
- CVE-2025-23259: issue in the Poll Mode Driver (PMD) allows an attacker on a VM in the system to leak information and cause a denial of service on the network interface (bsc#1254161).
Other issues fixed:
- Remove obsolete build option -Denable_kmods.
- Add "which" as a build requirement.
- Drop pesign and needssslcertforbuild because we don't build a kmp anymore (bsc#1247389).
- Record
SUSE-SU-2026:20209-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:20218-1 No score
Security update for dpdk
This update for dpdk fixes the following issues:
Update to version 24.11.4.
Security issues fixed:
- CVE-2025-23259: issue in the Poll Mode Driver (PMD) allows an attacker on a VM in the system to leak information and cause a denial of service on the network interface (bsc#1254161).
Other issues fixed:
- Remove obsolete build option -Denable_kmods.
- Add "which" as a build requirement.
- Drop pesign and needssslcertforbuild because we don't build a kmp anymore (bsc#1247389).
- Record
SUSE-SU-2026:20218-1- Updated
- 2026-11-02
OSVUSN-7816-1 No score
dpdk vulnerability
It was discovered that DPDK incorrectly handled the mlx5 Ethernet poll mode driver. An attacker could possibly use this issue to obtain sensitive information, or cause the network interface to crash, resulting in a denial of service.
- Record
USN-7816-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dpdkDebian:12 |
All versions, plus listed versions 22.11.1-222.11.11-0+deb12u122.11.2-122.11.2-222.11.2-2~deb12u1 Show 39 moreShow less22.11.2-322.11.3-122.11.3-1~deb12u122.11.3-222.11.4-1~deb12u122.11.5-1~deb12u122.11.6-1~deb12u122.11.7-1~deb12u122.11.8-1~deb12u122.11.9-1~deb12u123.11-123.11-1~exp123.11.1-123.11.1-223.11.2-123.11.2-1+exp123.11.2-1+exp223.11.2-1+exp323.11.2-1+exp423.11.2-223.11.2-324.11-124.11-224.11.1-124.11.2-124.11.2-224.11.3-124.11.3-1~deb13u124.11.3-224.11~rc2-124.11~rc2-224.11~rc3-124.11~rc4-125.11-125.11-225.11.1-125.11.2-125.11.3-125.11.4-1 |
None known |
dpdkDebian:13 |
before 24.11.3-1~deb13u1, plus listed versions 24.11.2-2 |
24.11.3-1~deb13u1 |
dpdkDebian:14 |
before 24.11.3-1, plus listed versions 24.11.2-224.11.3-1~deb13u1 |
24.11.3-1 |
dpdkSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 22.11.10-150600.3.15.1 | 22.11.10-150600.3.15.1 |
dpdk-thunderxSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 22.11.10-150600.3.15.1 | 22.11.10-150600.3.15.1 |
dpdkopenSUSE:Leap 15.6 |
before 22.11.10-150600.3.15.1 | 22.11.10-150600.3.15.1 |
dpdk-thunderxopenSUSE:Leap 15.6 |
before 22.11.10-150600.3.15.1 | 22.11.10-150600.3.15.1 |
dpdk22SUSE:Linux Enterprise Micro 5.5 |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22-thunderxSUSE:Linux Enterprise Micro 5.5 |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dpdk22-thunderxSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22-thunderxSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22SUSE:Linux Enterprise Server 15 SP5-LTSS |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22-thunderxSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22SUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22openSUSE:Leap 15.6 |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdk22-thunderxopenSUSE:Leap 15.6 |
before 22.11.10-150500.5.10.1 | 22.11.10-150500.5.10.1 |
dpdkSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 24.11.4-150700.3.6.1 | 24.11.4-150700.3.6.1 |
dpdk-thunderxSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 24.11.4-150700.3.6.1 | 24.11.4-150700.3.6.1 |
dpdkSUSE:Linux Micro 6.0 From an advisory covering 2 CVEs |
before 22.11.10-1.1 | 22.11.10-1.1 |
dpdkSUSE:Linux Micro 6.1 From an advisory covering 2 CVEs |
before 22.11.10-slfo.1.1_1.1 | 22.11.10-slfo.1.1_1.1 |
dpdkSUSE:Linux Micro 6.2 |
before 24.11.4-160000.1.1 | 24.11.4-160000.1.1 |
dpdkSUSE:Linux Enterprise Server 16.0 |
before 24.11.4-160000.1.1 | 24.11.4-160000.1.1 |
dpdkSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 24.11.4-160000.1.1 | 24.11.4-160000.1.1 |
dpdkUbuntu:16.04:LTS |
All versions, plus listed versions 2.0.0-0ubuntu12.0.0-0ubuntu22.0.0-0ubuntu32.2.0-0ubuntu12.2.0-0ubuntu3 Show 4 moreShow less2.2.0-0ubuntu52.2.0-0ubuntu62.2.0-0ubuntu72.2.0-0ubuntu8 |
None known |
dpdkUbuntu:18.04:LTS |
All versions, plus listed versions 17.05.2-0ubuntu117.05.2-0ubuntu217.11-317.11-417.11-5 Show 10 moreShow less17.11.1-617.11.2-1ubuntu0.117.11.3-3~ubuntu0.18.0417.11.5-0~ubuntu18.04.117.11.6-0~ubuntu18.04.117.11.8-0~ubuntu18.04.217.11.9-0ubuntu18.04.117.11.9-0ubuntu18.04.217.11.10-0ubuntu0.117.11.10-0ubuntu0.2 |
None known |
dpdkUbuntu:20.04:LTS |
All versions, plus listed versions 18.11.2-418.11.3-118.11.4-118.11.4-1ubuntu118.11.5-1 Show 13 moreShow less19.11-2ubuntu119.11-2ubuntu219.11.1-0ubuntu119.11.1-0ubuntu1.119.11.3-0ubuntu0.119.11.3-0ubuntu0.219.11.6-0ubuntu0.20.04.119.11.7-0ubuntu0.20.04.119.11.7-0ubuntu0.20.04.219.11.10-0ubuntu0.20.04.119.11.12-0ubuntu0.20.04.119.11.13-0ubuntu0.20.04.119.11.14-0ubuntu0.20.04.1 |
None known |
dpdkUbuntu:22.04:LTS |
before 21.11.9-0ubuntu0.22.04.2, plus listed versions 20.11.3-0ubuntu120.11.3-0ubuntu321.11-121.11-1build121.11.1-0ubuntu0.3 Show 6 moreShow less21.11.2-0ubuntu0.22.04.121.11.3-0ubuntu0.22.04.121.11.4-0ubuntu0.22.04.121.11.6-0ubuntu0.22.04.121.11.6-0ubuntu0.22.04.221.11.9-0ubuntu0.22.04.1 |
21.11.9-0ubuntu0.22.04.2 |
dpdkUbuntu:24.04:LTS |
before 23.11.4-0ubuntu0.24.04.2, plus listed versions 22.11.3-122.11.3-223.11-123.11-1build223.11-1build323.11-1ubuntu0.123.11.4-0ubuntu0.24.04.1 |
23.11.4-0ubuntu0.24.04.2 |
dpdkopenSUSE:Leap 16.0 |
before 24.11.4-160000.1.1 | 24.11.4-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23259 is a medium vulnerability (CVSS 6.5) in Nvidia Mellanox Dpdk 20.11, published September 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in dpdk 24.11.3-1~deb13u1.
References
nvd.nist.gov/vuln/detail/CVE-2025-23259
cve.org/CVERecord?id=CVE-2025-23259
nvidia.custhelp.com/app/answers/detail/a_id/5655
github.com/advisories/GHSA-xq47-rgwp-c6c5
security-tracker.debian.org/tracker/CVE-2025-23259
suse.com/support/update/announcement/2025/suse-su-20254254-1
Show 14 moreShow less
bugzilla.suse.com/1254161
ubuntu.com/security/CVE-2025-23259