CVE-2025-68816

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d
https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7
https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3
https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a
https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0
https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0
https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Configurations

No configuration.

History

19 Oct 2026, 19:17

Type	Values Removed	Values Added
CWE		CWE-134

15 Oct 2026, 02:18

Type	Values Removed	Values Added
References		() https://cert-portal.siemens.com/productcert/html/ssa-457936.html -

Information

Published : 2026-01-13 16:16

Updated : 2026-10-19 19:17

NVD link : CVE-2025-68816

Mitre link : CVE-2025-68816

CVE.ORG link : CVE-2025-68816

JSON object : View

Products Affected

No product.

CWE

CWE-134

Use of Externally-Controlled Format String

{"id": "CVE-2025-68816", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68816", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T19:11:19.183424Z"}}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "95624b731c490a4b849844269193a233d6d556a0", "versionType": "git"}, {"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "768d559f466cdd72849110a7ecd76a21d52dcfe3", "versionType": "git"}, {"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d", "versionType": "git"}, {"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "8ac688c0e430dab19f6a9b70df94b1f635612c1a", "versionType": "git"}, {"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "45bd283b1d69e2c97cddcb9956f0e0261fc4efd7", "versionType": "git"}, {"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "8c35c2448086870509ede43947845be0833251f0", "versionType": "git"}, {"status": "affected", "version": "70dd6fdb8987b14f7b6105f6be0617299e459398", "lessThan": "b35966042d20b14e2d83330049f77deec5229749", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c", "drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.248", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.198", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.160", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.120", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.64", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.3", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c", "drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h"], "defaultStatus": "affected"}]}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "affectedData": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-01-13T16:16:03.870", "references": [{"url": "https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\"BAD_FORMAT: \" prefix."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5: fw_tracer, Validar par\u00e1metros de cadena de formato\n\nA\u00f1adir validaci\u00f3n para los par\u00e1metros de cadena de formato en el trazador de firmware para prevenir posibles vulnerabilidades de seguridad y fallos causados por cadenas de formato malformadas recibidas del firmware.\n\nEl trazador de firmware recibe cadenas de formato del firmware del dispositivo y las utiliza para formatear mensajes de traza. Sin una validaci\u00f3n adecuada, un firmware defectuoso podr\u00eda proporcionar cadenas de formato con especificadores de formato inv\u00e1lidos (p. ej., %s, %p, %n) que podr\u00edan provocar fallos u otro comportamiento indefinido.\n\nA\u00f1adir mlx5_tracer_validate_params() para validar que todos los especificadores de formato en las cadenas de traza est\u00e9n limitados a formatos seguros de entero/hexadecimal (p. ej., %x, %d, %i, %u, %llx, %lx, etc.). Rechazar cadenas que contengan otros tipos de formato que podr\u00edan utilizarse para acceder a memoria arbitraria o causar fallos.\nLas cadenas de formato inv\u00e1lidas se a\u00f1aden a la salida de traza para visibilidad con el prefijo 'BAD_FORMAT: '."}], "lastModified": "2026-10-19T19:17:06.833", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}