Log in Start free

Vulnerability · Published Sep 4, 2025 · Assigned by nvidia

CVE-2025-23259

Medium 6.5

In plain English

A medium-severity race condition in Mellanox DPDK 20.11 from NVIDIA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 76.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause information disclosure and denial of service on the network interface.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12dpdkno fix listedDEBIAN-CVE-2025-23259
Debian:13dpdk24.11.3-1~deb13u1DEBIAN-CVE-2025-23259
Debian:14dpdk24.11.3-1DEBIAN-CVE-2025-23259
Ubuntu:22.04:LTSdpdk21.11.9-0ubuntu0.22.04.2USN-7816-1
Ubuntu:22.04:LTSdpdk21.11.9-0ubuntu0.22.04.2UBUNTU-CVE-2025-23259
Ubuntu:24.04:LTSdpdk23.11.4-0ubuntu0.24.04.2USN-7816-1
Ubuntu:24.04:LTSdpdk23.11.4-0ubuntu0.24.04.2UBUNTU-CVE-2025-23259

Affected products (as reported)

VendorProductVersions
NVIDIA Mellanox DPDK 22.11 All versions prior to 22.11_2504.1.0
NVIDIA Mellanox DPDK 22.11 All versions prior to 22.11_2410 LTS
NVIDIA Mellanox DPDK 22.11 All versions prior to 22.11_2310 LTS
NVIDIA Mellanox DPDK 20.11 All versions prior to 20.11_7.8.0 LTS
NVIDIA Upstream DPDK All versions prior to 25.07
NVIDIA Upstream DPDK All versions prior to 24.11.3 LTS
NVIDIA Upstream DPDK All versions prior to 23.11.5 LTS
NVIDIA Upstream DPDK All versions prior to 22.11.10 LTS

Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

References