CVE-2025-68790: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68790 is a use-after-free vulnerability in the Linux kernel's net/mlx5 driver caused by a double unregistration of the HCA_PORTS devcom component during LAG teardown. When mlx5_unload_one() is called twice in rapid succession — a scenario that occurs on s390 systems during PCI error recovery — the second call attempts to unregister an already-freed component, leading to kernel panics. The vulnerability was published on January 13, 2026, and affects the Linux kernel. Feedly estimates its severity as Medium, with an EPSS score of 0.00018 (Feedly, CVE.org).

The root cause is a missing pointer clear after unregistering the hca_devcom_comp component in the device's private data during LAG teardown (CWE-415: Double Free / CWE-416: Use-After-Free). On s390 architecture, PCI-level recovery events can trigger two concurrent passes through mlx5_unload_one() — one via poll_health() and one via mlx5_pci_err_detected() — causing the second pass to dereference a freed pointer (observed at address 6b6b6b6b6b6b6000, a classic KASAN poison pattern). The fix involves clearing the hca_devcom_comp pointer in device private data immediately after unregistering it, preventing the second pass from attempting re-unregistration (Feedly, CVE.org).

Successful triggering of this vulnerability results in a kernel panic (system crash), causing a complete loss of availability for the affected host. The crash is reproducible on s390 systems with PCI error recovery enabled and kernel debug features active, as evidenced by the reported Oops: 0038 kernel fault. There is no direct confidentiality or integrity impact beyond the denial-of-service caused by the kernel panic, though a crash in a virtualized or cloud environment could affect multiple tenants (Feedly).

The fix has been committed to the Linux stable kernel tree, clearing the hca_devcom_comp pointer after unregistration to prevent the double-free condition (patch commits 6a107cfe9c99 and d2495f529d60 in the stable tree). Users running affected kernel versions on s390 hardware with Mellanox mlx5 NICs should apply the relevant kernel update from their distribution (Red Hat and SUSE have tracked this issue per Vulners data). As a workaround, disabling PCI error recovery on affected systems may reduce exposure, though upgrading to a patched kernel is the recommended remediation (CVE.org, Feedly).