CVE-2025-68801: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68801 is a use-after-free vulnerability in the Linux kernel's mlxsw (Mellanox software) spectrum router driver (mlxsw_sp_neigh_entry_update). The flaw arises from improper reference counting on neighbour pointers, where the driver stores a pointer to a neighbour without holding a reference, allowing the object to be freed while still in use. It was published on January 13, 2026, and affects Linux kernel versions including those shipped with Microsoft Azure Linux 3 (azl3_kernel up to 6.6.119.3-3), as well as Debian and Ubuntu kernel packages. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The root cause is a use-after-free (CWE-416) in the neighbour entry reference counting scheme within the mlxsw_sp_router subsystem of the Linux kernel. The driver stored a pointer to a neighbour struct without incrementing its reference count; when the neighbour was freed (e.g., during RIF destruction via mlxsw_sp_router_rif_gone_sync), subsequent access in mlxsw_sp_neigh_entry_update would dereference the freed memory. The fix ensures a reference is always taken when storing a neighbour pointer in a neighbour entry, while avoiding double-counting when the neighbour is also referenced by a nexthop. The bug was detected via KASAN (Kernel Address Sanitizer) reporting a slab-use-after-free at mlxsw_sp_neigh_entry_update+0x2d4/0x310 and was reproducible by triggering network interface configuration operations such as unlinking a device from a VRF master (Microsoft MSRC).

Successful exploitation by a low-privileged local attacker can result in kernel memory corruption, potentially leading to arbitrary code execution in kernel context, sensitive information disclosure, or system denial of service (kernel crash). All three CIA pillars are affected: confidentiality (kernel memory read), integrity (memory corruption/code execution), and availability (system crash). The vulnerability is scoped to the local system and does not directly enable network-based lateral movement, but kernel-level code execution could facilitate privilege escalation and further compromise (Microsoft MSRC).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing KASAN reports such as BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310 or stack traces referencing mlxsw_sp_router_rif_gone_sync, mlxsw_sp_rif_destroy, or mlxsw_sp_inetaddr_port_vlan_event.
• Process: Unexpected kernel panics or system reboots on hosts using Mellanox Spectrum network adapters, particularly following network interface reconfiguration (e.g., VRF changes via the ip command).
• File System: Core dump files generated by kernel crashes on systems with Mellanox mlxsw drivers loaded.

Apply the kernel patches provided by upstream Linux stable trees (commits 4a3c569005f4, 8b0e69763ef9, 9e0a0d9eeb0d, 675c5aeadf64 on kernel.org). Downstream distributions have issued advisories and updated packages: Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), Debian (DSA-6126-1, DLA-4475-1, linux 6.1.162-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113), and Microsoft Azure Linux 3 (azl3_kernel 6.6.119.3-3 or later). As a workaround where patching is not immediately possible, restrict local user access on systems running Mellanox mlxsw drivers and monitor for unexpected kernel crashes or KASAN warnings (Microsoft MSRC, Ubuntu USN-8177-1, Debian LTS).