CVE-2025-68779
BaseFortify
Publication date: 2026-01-13
Last updated on: 2026-01-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the PSP (Packet Steering Profile) being unregistered twice in certain functions, leading to a reference count underflow. This causes a use-after-free condition, which can result in kernel warnings and potential instability or crashes. The issue arises because PSP cleanup is done twice: once directly in _mlx5e_remove and again during profile cleanup, which should be avoided.
How can this vulnerability impact me? :
The vulnerability can cause a reference count underflow and use-after-free in the kernel, potentially leading to system instability, crashes, or unexpected behavior in the network driver subsystem. This could affect system reliability and availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for refcount underflow warnings related to mlx5_core. Specifically, look for messages like 'refcount_t: underflow; use-after-free' and stack traces involving mlx5e_psp_unregister, mlx5e_nic_cleanup, and mlx5e_remove. You can use the command 'dmesg | grep refcount_t' or 'journalctl -k | grep refcount_t' to find such warnings in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is resolved. Avoid manually unregistering PSP in the _mlx5e_remove path, as PSP cleanup is handled during profile cleanup. Applying the official patch or kernel update that fixes the double unregistering of PSP will prevent the refcount underflow and use-after-free condition.