cbcvebase.
CVE-2025-68816
published 2026-01-13

CVE-2025-68816: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string…

PriorityP427high7.8
EPSS
0.18%
7.4th percentile
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, Validate format string parameters Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix.

Affected

51 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < 95624b731c490a4b849844269193a233d6d556a095624b731c490a4b849844269193a233d6d556a0
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < 768d559f466cdd72849110a7ecd76a21d52dcfe3768d559f466cdd72849110a7ecd76a21d52dcfe3
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < 38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < 8ac688c0e430dab19f6a9b70df94b1f635612c1a8ac688c0e430dab19f6a9b70df94b1f635612c1a
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < 45bd283b1d69e2c97cddcb9956f0e0261fc4efd745bd283b1d69e2c97cddcb9956f0e0261fc4efd7
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < 8c35c2448086870509ede43947845be0833251f08c35c2448086870509ede43947845be0833251f0
linuxlinux>= 70dd6fdb8987b14f7b6105f6be0617299e459398 < b35966042d20b14e2d83330049f77deec5229749b35966042d20b14e2d83330049f77deec5229749
linuxlinux_kernel>= 0 < 5.10.249-15.10.249-1
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.69-16.12.69-1
linuxlinux_kernel>= 0 < 6.18.3-16.18.3-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 4.19.0 < 5.10.2485.10.248
linuxlinux_kernel>= 5.11.0 < 5.15.1985.15.198
linuxlinux_kernel>= 5.16.0 < 6.1.1606.1.160
linuxlinux_kernel>= 6.13.0 < 6.18.36.18.3
linuxlinux_kernel>= 6.2.0 < 6.6.1206.6.120
linuxlinux_kernel>= 6.7.0 < 6.12.646.12.64
ubuntulinux-aws
ubuntulinux-aws-6.17
ubuntulinux-aws-fips
ubuntulinux-azure

CVSS provenance

osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat5.6MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.