CVE-2025-37865

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported

Russell King reports that on the ZII dev rev B, deleting a bridge VLAN

from a user port fails with -ENOENT:

https://lore.kernel.org/netdev/[email protected]/

This comes from mv88e6xxx_port_vlan_leave() -> mv88e6xxx_mst_put(),

which tries to find an MST entry in &chip->msts associated with the SID,

but fails and returns -ENOENT as such.

But we know that this chip does not support MST at all, so that is not

surprising. The question is why does the guard in mv88e6xxx_mst_put()

not exit early:

if (!sid)

return 0;

And the answer seems to be simple: the sid comes from vlan.sid which

supposedly was previously populated by mv88e6xxx_vtu_get().

But some chip->info->ops->vtu_getnext() implementations do not populate

vlan.sid, for example see mv88e6185_g1_vtu_getnext(). In that case,

later in mv88e6xxx_port_vlan_leave() we ar

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References