{"api_version":"1","generated_at":"2026-07-23T13:04:50+00:00","cve":"CVE-2025-68816","urls":{"html":"https://cve.report/CVE-2025-68816","api":"https://cve.report/api/cve/CVE-2025-68816.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-68816","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-68816"},"summary":{"title":"net/mlx5: fw_tracer, Validate format string parameters","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\"BAD_FORMAT: \" prefix.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-01-13 16:16:03","updated_at":"2026-07-14 13:18:00"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3","name":"https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749","name":"https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0","name":"https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7","name":"https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a","name":"https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d","name":"https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0","name":"https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68816","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68816","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 95624b731c490a4b849844269193a233d6d556a0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 768d559f466cdd72849110a7ecd76a21d52dcfe3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 8ac688c0e430dab19f6a9b70df94b1f635612c1a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 45bd283b1d69e2c97cddcb9956f0e0261fc4efd7 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 8c35c2448086870509ede43947845be0833251f0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 70dd6fdb8987b14f7b6105f6be0617299e459398 b35966042d20b14e2d83330049f77deec5229749 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.248 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.198 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.160 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.120 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.64 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.3 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"68816","cve":"CVE-2025-68816","epss":"0.001730000","percentile":"0.068820000","score_date":"2026-07-14","updated_at":"2026-07-15 00:14:55"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-68816","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-16T19:11:19.183424Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-06-16T19:11:38.420Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"affected":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-07-14T12:44:23.192Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c","drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"95624b731c490a4b849844269193a233d6d556a0","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"},{"lessThan":"768d559f466cdd72849110a7ecd76a21d52dcfe3","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"},{"lessThan":"38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"},{"lessThan":"8ac688c0e430dab19f6a9b70df94b1f635612c1a","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"},{"lessThan":"45bd283b1d69e2c97cddcb9956f0e0261fc4efd7","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"},{"lessThan":"8c35c2448086870509ede43947845be0833251f0","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"},{"lessThan":"b35966042d20b14e2d83330049f77deec5229749","status":"affected","version":"70dd6fdb8987b14f7b6105f6be0617299e459398","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c","drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.248","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.198","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.160","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.120","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.64","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.19","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.248","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.198","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.160","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.120","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.64","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.3","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19","versionStartIncluding":"4.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\"BAD_FORMAT: \" prefix."}],"providerMetadata":{"dateUpdated":"2026-05-11T21:53:52.560Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/95624b731c490a4b849844269193a233d6d556a0"},{"url":"https://git.kernel.org/stable/c/768d559f466cdd72849110a7ecd76a21d52dcfe3"},{"url":"https://git.kernel.org/stable/c/38ac688b52ef26a88f8bc4fe26d24fdd0ff91e5d"},{"url":"https://git.kernel.org/stable/c/8ac688c0e430dab19f6a9b70df94b1f635612c1a"},{"url":"https://git.kernel.org/stable/c/45bd283b1d69e2c97cddcb9956f0e0261fc4efd7"},{"url":"https://git.kernel.org/stable/c/8c35c2448086870509ede43947845be0833251f0"},{"url":"https://git.kernel.org/stable/c/b35966042d20b14e2d83330049f77deec5229749"}],"title":"net/mlx5: fw_tracer, Validate format string parameters","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-68816","datePublished":"2026-01-13T15:29:20.464Z","dateReserved":"2025-12-24T10:30:51.047Z","dateUpdated":"2026-07-14T12:44:23.192Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-01-13 16:16:03","lastModifiedDate":"2026-07-14 13:18:00","problem_types":[],"metrics":{"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-16T19:11:19.183424Z","id":"CVE-2025-68816","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"68816","Ordinal":"1","Title":"net/mlx5: fw_tracer, Validate format string parameters","CVE":"CVE-2025-68816","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"68816","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: fw_tracer, Validate format string parameters\n\nAdd validation for format string parameters in the firmware tracer to\nprevent potential security vulnerabilities and crashes from malformed\nformat strings received from firmware.\n\nThe firmware tracer receives format strings from the device firmware and\nuses them to format trace messages. Without proper validation, bad\nfirmware could provide format strings with invalid format specifiers\n(e.g., %s, %p, %n) that could lead to crashes, or other undefined\nbehavior.\n\nAdd mlx5_tracer_validate_params() to validate that all format specifiers\nin trace strings are limited to safe integer/hex formats (%x, %d, %i,\n%u, %llx, %lx, etc.). Reject strings containing other format types that\ncould be used to access arbitrary memory or cause crashes.\nInvalid format strings are added to the trace output for visibility with\n\"BAD_FORMAT: \" prefix.","Type":"Description","Title":"net/mlx5: fw_tracer, Validate format string parameters"}]}}}