CVE-2025-68800: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68800 is a use-after-free vulnerability in the Linux kernel's mlxsw spectrum_mr (multicast route) component, specifically in the mlxsw_sp_mr_stats_update function. The flaw arises when a multicast route replace operation deletes a list entry without acquiring the dedicated mutex that protects the multicast route list, allowing a concurrent periodic statistics update worker thread to access freed memory. It was published on January 13, 2026, and affects the Linux kernel (including Microsoft Azure Linux kernel version azl3_kernel_6.6.119.3-3) as well as distributions such as Red Hat Enterprise Linux, Debian, Ubuntu, SUSE, and Amazon Linux. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is a missing mutex acquisition during a multicast route replace operation in drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c (CWE-416: Use After Free). A prior commit introduced a dedicated mutex (replacing RTNL) to protect the multicast route list during periodic traversal by the mlxsw_sp_mr_stats_update worker; however, one code path — route replacement — omitted the mutex lock before deleting the list entry. This race condition allows the worker thread (running as a kworker) to read from a freed slab memory address (ffff8881523c2fa8) while traversing the list, as confirmed by KASAN reporting a slab-use-after-free read of size 8 in mlxsw_sp_mr_stats_update+0x4a5/0x540. Exploitation requires local access with low privileges and no user interaction. The fix involves acquiring the mutex before deleting the route entry and releasing it afterward (Red Hat CVE).

A local attacker with low privileges can trigger the use-after-free condition to cause kernel memory corruption, leading to a kernel crash (denial of service) or potential privilege escalation. The vulnerability has high integrity and availability impact but no direct confidentiality impact, as the flaw manifests as a slab-use-after-free read in a kernel worker thread processing multicast route statistics. Systems running Mellanox Spectrum-based network hardware with multicast routing enabled are specifically at risk, and exploitation could destabilize the entire host (Red Hat CVE, Microsoft MSRC).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing KASAN reports such as BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006.
• Process: Unexpected kernel panics or oops traces involving kworker processes associated with mlxsw_core workqueue and the mlxsw_sp_mr_stats_update function.
• System Behavior: Sudden kernel crashes or system instability on hosts running Mellanox Spectrum hardware with multicast routing configured, particularly during multicast route replace operations.

Apply the upstream Linux kernel patch that adds proper mutex acquisition before deleting multicast route list entries in spectrum_mr.c (commits 5f2831fc593c, 6e367c361a52, 8ac1dacec458, 37ca08b35a27 on stable branches). Vendor-specific patches have been released by Red Hat (RHSA-2026:3083, RHSA-2026:3110, RHSA-2026:3275, RHSA-2026:4759, RHSA-2026:9512, RHSA-2026:9644, RHSA-2026:10108), Microsoft (Azure Linux kernel azl3_kernel_6.6.119.3-3), Debian (linux 6.1.162-1, 5.10.249-1), Ubuntu (USN-8177-1/2, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), SUSE, and Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113). As a workaround where patching is not immediately possible, restrict local system access to trusted users only and avoid multicast route replace operations on affected hardware (Red Hat CVE, Red Hat Errata).