NVIDIA Issues Security Updates for BlueField, DOCA, Mellanox, ConnectX, Cumulus Linux, and NVOS

NVIDIA has issued a batch of security updates addressing vulnerabilities across BlueField DPUs, DOCA, Mellanox, ConnectX, Cumulus Linux and NVOS, with several flaws rated high to critical in impact. According to NVIDIA, the most severe, CVE-2025-23256, affects the BlueField management interface and could allow a local attacker to cause incorrect authorisation, potentially leading to denial of service, privilege escalation, information disclosure and data tampering.

Patches are available for BlueField-2 and BlueField-3, with updated builds 45.1020, 35.4554 (LTS22), 39.5050 (LTS23) and 43.3608 (LTS24). Two privilege escalation flaws, CVE-2025-23257 and CVE-2025-23258, affect DOCA’s Debian packages and carry a CVSS of 7.3, with patches in DOCA 2.9.3, 2.5.4 and 3.0.0. Another issue, CVE-2025-23259, concerns the Mellanox DPDK PMD and could enable information disclosure and denial of service on the network interface, fixed in various DPDK and LTS releases.

The advisory notes a separate vulnerability, CVE-2025-23262, in ConnectX adapters permitting local attackers to bypass authorisation and tamper with configuration data, with updates for ConnectX-5 through 8 across GA and LTS branches, while CVE-2025-23261 affects Cumulus Linux and NVOS by exposing hashed passwords in logs, with fixes in Cumulus Linux 5.13 and NVOS 25.02.42xx and 25.02.4xxx.