CVE-2025-68790: net/mlx5: Fix double unregister of HCA_PORTS component
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix double unregister of HCAPORTS component
Clear hcadevcomcomp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through mlx5unloadone() might try to unregister it again and trip over use-after-free.
On s390 almost all PCI level recovery events trigger two passes through mxl5unloadone() - one through the pollhealth() method and one through mlx5pcierrdetected() as callback from generic PCI error recovery. While testing PCI error recovery paths with more kernel debug features enabled, this issue reproducibly led to kernel panics with the following call chain:
Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI Fault in home space mode while using kernel ASCE. AS:00000000705c4007 R3:0000000000000024 Oops: 0038 ilc:3 [#1]SMP
CPU: 14 UID: 0 PID: 156 Comm: kmcheck Kdump: loaded Not tainted 6.18.0-20251130.rc7.git0.16131a59cab1.300.fc43.s390x+debug #1 PREEMPT
Krnl PSW : 0404e00180000000 0000020fc86aa1dc (lockacquire+0x5c/0x15f0) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 0000020f00000001 6b6b6b6b6b6b6c33 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000020fca28b820 0000000000000000 0000010a1ced8100 0000010a1ced8100 0000020fc9775068 0000018fce14f8b8 0000018fce14f7f8 Krnl Code: 0000020fc86aa1cc: e3b003400004 lg %r11,832 0000020fc86aa1d2: a7840211 brc 8,0000020fc86aa5f4 0000020fc86aa1d6: c09000df0b25 larl %r9,0000020fca28b820 >0000020fc86aa1dc: d50790002000 clc 0(8,%r9),0(%r2) 0000020fc86aa1e2: a7840209 brc 8,0000020fc86aa5f4 0000020fc86aa1e6: c0e001100401 larl %r14,0000020fca8aa9e8 0000020fc86aa1ec: c01000e25a00 larl %r1,0000020fca2f55ec 0000020fc86aa1f2: a7eb00e8 aghi %r14,232
Call Trace: lockacquire+0x5c/0x15f0 lockacquire.part.0+0xf8/0x270 lockacquire+0xb0/0x1b0 downwrite+0x5a/0x250 mlx5detachdevice+0x42/0x110 [mlx5core] mlx5unloadonedevllocked+0x50/0xc0 [mlx5core] mlx5unloadone+0x42/0x60 [mlx5core] mlx5pcierrdetected+0x94/0x150 [mlx5core] zpcieventattempterrorrecovery+0xcc/0x388
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68790?
CVE-2025-68790 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-68790?
To fix CVE-2025-68790, update your Linux kernel to the latest patched version provided by your distribution.
What components are affected by CVE-2025-68790?
CVE-2025-68790 affects the net/mlx5 driver, specifically related to the improper handling of HCA_PORTS during unregistering.
Is CVE-2025-68790 a remote exploit risk?
CVE-2025-68790 does not present a remote exploit risk but could lead to stability issues in affected systems.
Has CVE-2025-68790 been mitigated in recent updates?
Yes, CVE-2025-68790 has been addressed in recent updates to the Linux kernel.