CVE-2025-68779: net/mlx5e: Avoid unregistering PSP twice
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Avoid unregistering PSP twice
PSP is unregistered twice in: mlx5eremove -> mlx5epspunregister mlx5eniccleanup -> mlx5epspunregister
This leads to a refcount underflow in some conditions: ------------[ cut here ]------------ refcountt: underflow; use-after-free. WARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcountwarnsaturate+0xd8/0xe0 [...] mlx5epspunregister+0x26/0x50 [mlx5core] mlx5eniccleanup+0x26/0x90 [mlx5core] mlx5eremove+0xe6/0x1f0 [mlx5core] auxiliarybusremove+0x18/0x30 devicereleasedriverinternal+0x194/0x1f0 busremovedevice+0xc6/0x130 devicedel+0x159/0x3c0 mlx5rescandriverslocked+0xbc/0x2a0 [mlx5core] [...]
Do not directly remove psp from the mlx5eremove path, the PSP cleanup happens as part of profile cleanup.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68779?
CVE-2025-68779 has a medium severity rating due to the potential for a refcount underflow leading to instability.
How do I fix CVE-2025-68779?
To fix CVE-2025-68779, update your Linux kernel to a version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-68779?
CVE-2025-68779 affects certain versions of the Linux kernel that utilize the mlx5e driver.
What are the implications of CVE-2025-68779?
The implications of CVE-2025-68779 include potential system crashes or instability due to improper resource management.
Is CVE-2025-68779 publicly disclosed?
Yes, CVE-2025-68779 has been publicly disclosed and documented in security advisories.