CVE-2025-68779: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68779 is a use-after-free vulnerability in the Linux kernel's net/mlx5e driver caused by double unregistration of the PSP (Packet Steering Policy) subsystem during device removal. The flaw was published on January 13, 2026, and affects Linux kernel versions from commit 89ee2d92f66c up to the fixes applied in kernel 6.18.3 and 6.19-rc2. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium, and the ENISA EUVD records a base score of 0.0 pending full analysis (Red Hat CVE, ENISA EUVD).

The root cause is a double-free / refcount underflow (related to CWE-911: Improper Update of Reference Count) in the mlx5_core kernel module. During device removal, mlx5e_psp_unregister() is called twice: once directly from _mlx5e_remove() and again from mlx5e_nic_cleanup() as part of profile cleanup. This causes a refcount_t underflow, triggering a kernel warning (refcount_warn_saturate) and a use-after-free condition in lib/refcount.c. The fix removes the direct PSP unregistration call from the _mlx5e_remove path, relying solely on the profile cleanup path (Red Hat CVE, kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability can result in kernel memory corruption due to the use-after-free condition triggered during Mellanox mlx5e NIC driver teardown. In practice, this manifests as a kernel warning and potential system instability or crash (denial of service) on systems using affected Mellanox/NVIDIA ConnectX network adapters. Privilege escalation or remote code execution is theoretically possible via use-after-free primitives, though the local and hardware-specific nature of the trigger significantly limits the practical attack surface (Red Hat CVE).

The vulnerability is fixed in Linux kernel versions 6.18.3 and 6.19-rc2 via upstream commits 35e93736f699 and e12c912f92cc. Users should update to a patched kernel version as soon as it is available from their distribution vendor (e.g., Red Hat, SUSE, Ubuntu). As a temporary workaround, avoiding dynamic driver unbind/rebind operations on systems using Mellanox mlx5e NICs can reduce exposure until a patched kernel is deployed (kernel.org patch 1, kernel.org patch 2, Red Hat CVE).