CVE-2025-39834

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.

Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.19%Up 0.2 points since Sep 17, 2025

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.

Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Record: CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-401
Updated: 2026-11-02

CVE List 5.5

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.

Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Record: CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-401
Updated: 2026-11-02

EUVDEUVD-2025-29580 5.5

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.

Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Record: EUVD-2025-29580
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-45vc-784v-vp78 5.5

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory...

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.

Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Record: GHSA-45vc-784v-vp78
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-401
Updated: 2026-11-02

OSVBELL-CVE-2025-39834 5.5

Record: BELL-CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 5.5

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow

When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak.

Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Record: CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 12 moreShow less

OSVDEBIAN-CVE-2025-39834 5.5

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak. Fix by jumping to free_shared_stc label instead to ensure proper cleanup.

Record: DEBIAN-CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2025-39834 5.5

CVE-2025-39834 in linux - Patched by Root

Root has patched CVE-2025-39834 in the linux package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVUBUNTU-CVE-2025-39834 5.5

Record: UBUNTU-CVE-2025-39834
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1787305050 No score

kernel: Fix of 87 CVEs

sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187}
sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221}
cifs: some missing initializations on replay {CVE-2026-31693}
drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
net/tcp-md5: Fix MAC comparison to be constant-time {CVE-2026-43383}
ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740}
accel/ivpu: Add bounds check for firmware runtime memory {CVE-2026-53206}
ata: libata-core: Disable LPM on ST1000DM010-2EP102 {CVE-2026-43487}
ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764}
bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336}
mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
spi: fix use-after-free on controller registration failure {CVE-2026-31389}
nvme: fix admin request_queue lifetime {CVE-2025-68265}
RDMA/bnxt_re: Add sanity checks on rdev validity {CVE-2025-21901}
smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow {CVE-2025-39834}
sctp: Fix MAC comparison to be constant-time {CVE-2025-40204}
net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path {CVE-2025-39830}
nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() {CVE-2026-23297}
thermal/of: Fix reference leak in thermal_of_cm_lookup() {CVE-2026-45925}
usbnet: Prevents free active kevent {CVE-2025-68312}
smb: client: fix oops due to uninitialised var in smb2_unlink() {CVE-2026-23282}
fs/buffer: add alert in try_to_free_buffers() for folios without buffers {CVE-2025-71295}
cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update {CVE-2025-23137}
Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync {CVE-2026-53251}
wifi: iwlwifi: mvm: don't send a 6E related command when not supported {CVE-2026-43325}
io_uring/napi: cap busy_poll_to 10 msec {CVE-2026-53321}
io_uring/net: fix io_req_post_cqe abuse by send bundle {CVE-2025-23154}
xfs: fix a resource leak in xfs_alloc_buftarg() {CVE-2026-46005}
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() {CVE-2026-68444}
i2c: core: fix adapter deregistration race {CVE-2026-64279}
wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() {CVE-2026-68439}
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration {CVE-2026-64166}
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() {CVE-2026-68309}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408}
accel/ivpu: Add bounds checks for firmware log indices {CVE-2026-53205}
PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails {CVE-2026-45880}
nvme-multipath: fix lockdep WARN due to partition scan work {CVE-2025-68218}
dm: fix unlocked test for dm_suspended_md {CVE-2026-46327}
net: slip: serialize receive against buffer reallocation…

Record: CLSA-2026-1787305050
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20081-1 No score