CVE-2025-38590: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: Remove skb secpath if xfrm state is not found  Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup.  Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0.  Subsequently, functions like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer.  This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath.   BUG: unable to handle page fault for address: ffffffff000002c8  #PF: supervisor read access in kernel mode  #PF: error_code(0x0000) - not-present page  PGD 282e067 P4D 282e067 PUD 0  Oops: Oops: 0000 [#1] SMP  CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014  RIP: 0010:__xfrm_policy_check+0x61a/0xa30  Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa  RSP: 0018:ffff88885fb04918 EFLAGS: 00010297  RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000  RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000  RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353  R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8  R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00  FS:  0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400  Call Trace:   <IRQ>   ? try_to_wake_up+0x108/0x4c0   ? udp4_lib_lookup2+0xbe/0x150   ? udp_lib_lport_inuse+0x100/0x100   ? __udp4_lib_lookup+0x2b0/0x410   __xfrm_policy_check2.constprop.0+0x11e/0x130   udp_queue_rcv_one_skb+0x1d/0x530   udp_unicast_rcv_skb+0x76/0x90   __udp4_lib_rcv+0xa64/0xe90   ip_protocol_deliver_rcu+0x20/0x130   ip_local_deliver_finish+0x75/0xa0   ip_local_deliver+0xc1/0xd0   ? ip_protocol_deliver_rcu+0x130/0x130   ip_sublist_rcv+0x1f9/0x240   ? ip_rcv_finish_core+0x430/0x430   ip_list_rcv+0xfc/0x130   __netif_receive_skb_list_core+0x181/0x1e0   netif_receive_skb_list_internal+0x200/0x360   ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core]   gro_receive_skb+0xfd/0x210   mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core]   mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core]   ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core]   mlx5e_napi_poll+0x114/0xab0 [mlx5_core]   __napi_poll+0x25/0x170   net_rx_action+0x32d/0x3a0   ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core]   ? notifier_call_chain+0x33/0xa0   handle_softirqs+0xda/0x250   irq_exit_rcu+0x6d/0xc0   common_interrupt+0x81/0xa0   </IRQ>