Security readout for executives and security teams
Plain-English summary
A race condition in the Linux Mellanox Spectrum network-switch driver can access memory after it has been freed while multicast routes are replaced and statistics are updated. This can destabilize or potentially compromise the kernel. The supplied CVSS score is 7.8, but exploitation requires local low-privilege access and affected driver functionality.
Executive priority
Treat as a high-priority, targeted kernel update for systems using Mellanox Spectrum multicast routing, especially shared or multi-user infrastructure. It is not evidence of an internet-wide emergency: the stated attack path is local, and active exploitation is not established. Confirm asset exposure first, then patch affected systems through supported distribution channels.
Technical view
The mlxsw Spectrum multicast-routing code failed to hold its dedicated route-list mutex during one route-replacement deletion path. A concurrent statistics worker could traverse the deleted entry, causing a slab use-after-free in mlxsw_sp_mr_stats_update. The fix surrounds that deletion with the mutex. KASAN reproduced the flaw on Mellanox Spectrum hardware.
Likely exposure
Exposure is most likely on Linux systems using the mlxsw_spectrum driver with Mellanox Spectrum hardware and multicast-routing activity. Systems without this driver or relevant hardware are unlikely to reach the vulnerable path. The bundle's version data is insufficient for reliably determining individual distribution backports.
Exploitation context
The supplied vector requires local access with low privileges, no user interaction, and low attack complexity. Neither KEV status nor the provided sources establish active exploitation or a public working exploit. The demonstrated evidence is a KASAN-detected kernel use-after-free; practical security impact beyond that crash evidence is not documented here.
Researcher notes
The trigger involves concurrent multicast-route replacement and periodic hardware-statistics traversal. The source demonstrates an eight-byte read from freed slab memory, not a documented exploitation primitive. Multiple stable commits are supplied, apparently for separate kernel branches. Exact vulnerable and fixed package versions remain distribution-dependent and should not be inferred solely from the bundle's unusual version listing.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable-branch fix.
- Confirm distribution backport status rather than relying only on the displayed kernel version.
- Prioritize exposed multi-user systems using Mellanox Spectrum multicast routing.
- If patching is delayed, consult vendor guidance for supported exposure-reduction measures.
- Restrict unnecessary local account access until remediation is confirmed.
Validation and detection
- Inventory kernels, Mellanox Spectrum hardware, and loaded mlxsw_spectrum modules.
- Determine whether multicast routing is configured on each potentially affected system.
- Match the installed kernel package against distribution security and backport records.
- Verify the kernel source or package includes the applicable referenced fix commit.
- Review kernel logs for mlxsw-related crashes or memory-corruption reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68800 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/b957366f5611bbaba03dd10ef861283347ddcc88CVE reference, Linux
- https://git.kernel.org/stable/c/6e367c361a523a4b54fe618215c64a0ee189caf0CVE reference, Linux
- https://git.kernel.org/stable/c/37ca08b35a27ce8fd8e74dd3fd2ae21c23b63b73CVE reference, Linux
- https://git.kernel.org/stable/c/5f2831fc593c2b2efbff7dd0dd7441cec76adcd5CVE reference, Linux
- https://git.kernel.org/stable/c/216afc198484fde110ebeafc017992266f4596ceCVE reference, Linux
- https://git.kernel.org/stable/c/4049a6ace209f4ed150429f86ae796d7d6a4c22bCVE reference, Linux
- https://git.kernel.org/stable/c/8ac1dacec458f55f871f7153242ed6ab60373b90CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.