Security readout for executives and security teams
Plain-English summary
CVE-2025-68790 is a Linux kernel bug in the mlx5 network driver. During certain device teardown and PCI error recovery flows, the kernel can try to unregister the same component twice, causing a use-after-free and kernel panic. The public record describes reproducible crashes in debug testing, especially on s390 recovery paths.
Executive priority
Treat as a targeted availability risk for infrastructure using mlx5 networking, especially specialized Linux or s390 environments. It does not currently show evidence of active exploitation, but affected production hosts should receive normal kernel maintenance priority because crashes can disrupt workloads.
Technical view
The issue is in net/mlx5 LAG teardown. hca_devcom_comp was not cleared after unregistering HCA_PORTS, allowing a second mlx5_unload_one() path to unregister it again. The CVE record links this to use-after-free and kernel panic during PCI error recovery, with call traces through mlx5_pci_err_detected() and mlx5_unload_one().
Likely exposure
Most relevant to Linux systems using the mlx5_core driver, LAG-related paths, and PCI error recovery conditions. The source specifically notes s390 where recovery may invoke two unload paths. The listed affected range includes Linux 6.18 through before 6.18.3 and 6.19 data, but version metadata appears limited.
Exploitation context
No public source in the bundle states active exploitation, and KEV is false. The described trigger is a kernel recovery/teardown race-like condition, not a remote application-layer attack. Practical risk is availability impact through kernel panic under specific hardware and recovery circumstances.
Researcher notes
The public description is unusually specific about root cause and call path, but lacks CVSS, CWE, and broad distro status. Avoid assuming exploitability beyond the described panic. The main validation task is mapping downstream kernel packages to the two stable commits and confirming mlx5_core exposure.
Mitigation direction
- Review vendor kernel advisories for CVE-2025-68790 and mlx5 fixes.
- Apply kernels containing the referenced stable commits when available from your vendor.
- Prioritize hosts using mlx5_core with LAG or s390 PCI recovery exposure.
- If patching is delayed, monitor for PCI recovery events and kernel panics.
Validation and detection
- Inventory Linux kernel versions against the CVE affected range.
- Identify systems loading the mlx5_core driver.
- Check whether affected systems use LAG or similar mlx5 teardown paths.
- Confirm vendor kernel changelogs include the referenced HCA_PORTS unregister fix.
- Review crash logs for mlx5_unload_one or mlx5_pci_err_detected traces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68790 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d2495f529d60e8e8c43e6ad524089c38b8be7bc4CVE reference, Linux
- https://git.kernel.org/stable/c/6a107cfe9c99a079e578a4c5eb70038101a3599fCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.