CVE-2025-23257

HighCVSS 7.3/10Last modified Sep 30, 2026

Description

NVIDIA DOCA contains a vulnerability in the collectx-clxapidev Debian package that could allow an actor with low privileges to escalate privileges. A successful exploit of this vulnerability might lead to escalation of privileges.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
NVIDIA	NVIDIA DOCA with collectx-clxapidev	All 2.9 versions prior to 2.9.3
NVIDIA	NVIDIA DOCA with collectx-clxapidev	All 2.10 versions

References

Timeline

Published: Sep 4, 2025
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-232587.3NVIDIA DOCA contains a vulnerability in the collectx-dpeserver Debian package for arm64 that could allow an attacker with low privileges to CVE-2025-232596.5NVIDIA Mellanox DPDK contains a vulnerability in Poll Mode Driver (PMD), where an attacker on a VM in the system might be able to cause info CVE-2025-232604.3NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount at CVE-2025-232615.5NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potent CVE-2025-232626.3NVIDIA ConnectX contains a vulnerability in the management interface, where an attacker with local access could cause incorrect authorizatio CVE-2025-232637.6NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileg CVE-2025-232647.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr CVE-2025-232657.8NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by pr CVE-2025-232669.0NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could CVE-2025-232678.5NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link followi CVE-2025-232689.8NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may cause an improper input validation issue. CVE-2025-232694.7NVIDIA Jetson Linux contains a vulnerability in the kernel where an attacker may cause an exposure of sensitive information due to a shared