What’s Vulnerable › Vulnerabilities

CVE-2025-38039: net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-18 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled When attempting to enable MQPRIO while HTB offload is already configured, the driver currently returns `-EINVAL` and triggers a `WARN_ON`, leading to an unnecessary call trace. Update the code to handle this case more gracefully by returning `-EOPNOTSUPP` instead, while also providing a helpful user message.

Affected products

• Linux kernel: before 6.6.93; from 6.7 before 6.12.31; from 6.13 before 6.14.9 — fixed in 6.12.31, 6.14.9, 6.6.93

How to fix

Upgrade to a fixed version: Linux kernel 6.12.31, 6.14.9, 6.6.93. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/090c0ba179eaf7b670e720aa054533756a43d565
• https://git.kernel.org/stable/c/689805dcc474c2accb5cffbbcea1c06ee4a54570
• https://git.kernel.org/stable/c/9e2bac6835f73895598df5a3a125a19497fad46b
• https://git.kernel.org/stable/c/b82e496531c571caf8a2ef247f51c160bab2162e

Get alerted when CVE-2025-38039 or the next vulnerability affects your stack