Security readout for executives and security teams
Plain-English summary
A Linux networking driver can access memory after it has been freed during certain neighbour and routing changes. On affected systems using the mlxsw Spectrum router driver, this may crash or corrupt the kernel and, according to the supplied CVSS assessment, could affect confidentiality, integrity, and availability. General Linux hosts that do not use this driver are unlikely to be exposed.
Executive priority
Treat this as high priority for production switches or routing hosts that use mlxsw, because a kernel memory-safety fault can threaten network availability and potentially broader system security. Schedule the applicable stable-kernel update promptly with redundancy and failover planning. For fleets without the driver or hardware, document non-exposure rather than initiating emergency maintenance.
Technical view
The mlxsw Spectrum router driver kept a neighbour pointer without holding a reference unless a nexthop used it. Lifecycle activity could free the neighbour before mlxsw_sp_neigh_entry_update dereferenced it, producing a slab use-after-free. The fix makes neighbour entries always retain a reference and removes redundant nexthop reference handling. The reported reproducer involved routing-interface teardown and network configuration events.
Likely exposure
Exposure is concentrated in Linux systems using the mlxsw Spectrum routing path, associated with NVIDIA Spectrum switch hardware. The fault was observed during neighbour, nexthop, interface, VRF, and routing lifecycle activity. The supplied affected-version data spans multiple kernel branches but is ambiguous, so confirm the exact fixed build with the distributor or matching stable commit.
Exploitation context
The supplied CVSS 3.1 score is 7.8: local attack vector, low complexity, low privileges, and no user interaction. The bundle marks KEV false and provides no evidence of active exploitation or a public exploit. Demonstrated evidence is a reproducible KASAN-detected kernel use-after-free; real-world security impact beyond that is not documented here.
Researcher notes
Root cause is missing neighbour-object ownership: the driver stored a pointer without a reference, allowing delayed freeing before later dereference. The patch references every stored neighbour entry. The source reports more than 300 successful test iterations after repair, versus reproduction after only a few iterations beforehand. No CWE is assigned, and no exploitability proof is supplied.
Mitigation direction
- Update to a vendor-supported Linux kernel containing the applicable stable fix for your kernel branch.
- Prioritize network switches and routing hosts that load mlxsw and use NVIDIA Spectrum hardware.
- If immediate updates are unavailable, obtain branch-specific mitigation guidance from your Linux distributor.
- Plan redundancy or traffic failover because kernel updates may require a reboot.
Validation and detection
- Inventory kernel versions and determine whether the mlxsw Spectrum router driver is loaded.
- Identify systems using NVIDIA Spectrum hardware and Linux routing, VRF, neighbour, or nexthop features.
- Verify the installed kernel includes the corresponding stable commit for its maintained branch.
- After updating, confirm the new kernel is running and review logs for mlxsw-related memory faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68801 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a2dfe6758fc63e542105bee8b17a3a7485684db0CVE reference, Linux
- https://git.kernel.org/stable/c/9e0a0d9eeb0dbeba2c83fa837885b19b8b9230fcCVE reference, Linux
- https://git.kernel.org/stable/c/c437fbfd4382412598cdda1f8e2881b523668cc2CVE reference, Linux
- https://git.kernel.org/stable/c/4a3c569005f42ab5e5b2ad637132a33bf102cc08CVE reference, Linux
- https://git.kernel.org/stable/c/ed8141b206bdcfd5d0b92c90832eeb77b7a60a0aCVE reference, Linux
- https://git.kernel.org/stable/c/675c5aeadf6472672c472dc0f26401e4fcfbf254CVE reference, Linux
- https://git.kernel.org/stable/c/8b0e69763ef948fb872a7767df4be665d18f5fd4CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.