LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68779: net/mlx5e: Avoid unregistering PSP twice

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid unregistering PSP twice PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister This leads to a refcount underflow in some conditions: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0 [...] mlx5e_psp_unregister+0x26/0x50 [mlx5_core] mlx5e_nic_cleanup+0x26/0x90 [mlx5_core] mlx5e_remove+0xe6/0x1f0 [mlx5_core] auxiliary_bus_remove+0x18/0x30 device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 mlx5_rescan_drivers_locked+0xbc/0x2a0 [mlx5_core] [...] Do not directly remove psp from the _mlx5e_remove path, the PSP cleanup happens as part of profile cleanup.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue affects the mlx5e network driver. During certain removal or driver-rescan paths, PSP cleanup could run twice, causing a reference-count underflow and a use-after-free warning. The public sources do not provide CVSS, impact scope, or evidence of active exploitation.

Executive priority

Treat as a targeted kernel maintenance issue, not an emergency based on current evidence. Prioritize patching for systems with mlx5e networking hardware or frequent driver rescans/removal operations, while tracking vendor guidance for final severity and package status.

Technical view

The bug is a double unregister of PSP in mlx5e: both _mlx5e_remove and mlx5e_nic_cleanup call mlx5e_psp_unregister. The fix removes direct PSP cleanup from the remove path because profile cleanup already handles it. The observed failure is a refcount underflow/use-after-free warning in mlx5_core during device removal.

Likely exposure

Exposure appears limited to Linux systems using the mlx5e driver path referenced by the kernel fix. The bundle lists Linux as affected and includes 6.18, 6.18.3, and 6.19 version data, but the provided version semantics are incomplete.

Exploitation context

The source bundle reports no KEV listing and provides no public exploitation evidence. Available evidence shows a kernel cleanup bug triggered in removal or rescan conditions, not a documented remote attack path.

Researcher notes

The available record is sparse: no CVSS, no CWE, no exploit claims, and limited affected-version clarity. Analysis should focus on the mlx5e PSP lifecycle and whether double unregister can produce practical impact beyond warning and potential use-after-free conditions.

Mitigation direction

  • Review Linux vendor advisories for corrected kernel packages.
  • Prioritize hosts using mlx5e-capable Mellanox/NVIDIA networking hardware.
  • Plan kernel updates that include the referenced stable commits.
  • Avoid manual driver churn on exposed production systems until patched.

Validation and detection

  • Check whether systems load the mlx5_core or mlx5e driver.
  • Map running kernel versions against vendor advisories and fixed packages.
  • Review kernel logs for refcount underflow or use-after-free warnings in mlx5_core.
  • Confirm deployed kernels include the referenced upstream stable fixes.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68779 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux89ee2d92f66c45625ff1c173df2dbdea32568c5d, 89ee2d92f66c45625ff1c173df2dbdea32568c5dunaffected
LinuxLinux6.18, 0, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.