CVE-2025-68816net/mlx5: fw_tracer, Validate format string parameters
Updated under an hour ago ()
Does this affect you?
It affects Linux and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 70dd6fdb8987b14f7b6105f6be0617299e459398 before 95624b731c490a4b849844269193a233d6d556a0; from 70dd6fdb8987b14f7b6105f6be0617299e459398 before 768d559f466cdd72849110a7ecd76a21d52dcfe3; 70dd6fdb8987b14f7b6105f6be0617299e459398 builds before 38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d; 70dd6fdb8987b14f7b6105f6be0617299e459398 builds before 8ac688c0e430dab19f6a9b70df94b1f635612c1a; 70dd6fdb8987b14f7b6105f6be0617299e459398 builds before 45bd283b1d69e2c97cddcb9956f0e0261fc4efd7; 70dd6fdb8987b14f7b6105f6be0617299e459398 builds before 8c35c2448086870509ede43947845be0833251f0; from 70dd6fdb8987b14f7b6105f6be0617299e459398 before b35966042d20b14e2d83330049f77deec5229749 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
References
- https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0
- https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3
- https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d
- https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a
- https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7
- https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0
- https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.