« Volver al listado

CVE-2025-68779

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Avoid unregistering PSP twice

PSP is unregistered twice in: _mlx5e_remove -> mlx5e_psp_unregister mlx5e_nic_cleanup -> mlx5e_psp_unregister

Do not directly remove psp from the _mlx5e_remove path, the PSP cleanup happens as part of profile cleanup.

Detalles técnicos trazas, registros y código del informe original
This leads to a refcount underflow in some conditions:
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0
[...]
 mlx5e_psp_unregister+0x26/0x50 [mlx5_core]
 mlx5e_nic_cleanup+0x26/0x90 [mlx5_core]
 mlx5e_remove+0xe6/0x1f0 [mlx5_core]
 auxiliary_bus_remove+0x18/0x30
 device_release_driver_internal+0x194/0x1f0
 bus_remove_device+0xc6/0x130
 device_del+0x159/0x3c0
 mlx5_rescan_drivers_locked+0xbc/0x2a0 [mlx5_core]
[...]

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68779",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "89ee2d92f66c45625ff1c173df2dbdea32568c5d",
              "lessThan": "e12c912f92ccea671b514caf371f28485714bb4b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "89ee2d92f66c45625ff1c173df2dbdea32568c5d",
              "lessThan": "35e93736f69963337912594eb3951ab320b77521",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-13T16:15:57.550",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/35e93736f69963337912594eb3951ab320b77521",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e12c912f92ccea671b514caf371f28485714bb4b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Avoid unregistering PSP twice\n\nPSP is unregistered twice in:\n_mlx5e_remove -> mlx5e_psp_unregister\nmlx5e_nic_cleanup -> mlx5e_psp_unregister\n\nThis leads to a refcount underflow in some conditions:\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\nWARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0\n[...]\n mlx5e_psp_unregister+0x26/0x50 [mlx5_core]\n mlx5e_nic_cleanup+0x26/0x90 [mlx5_core]\n mlx5e_remove+0xe6/0x1f0 [mlx5_core]\n auxiliary_bus_remove+0x18/0x30\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xc6/0x130\n device_del+0x159/0x3c0\n mlx5_rescan_drivers_locked+0xbc/0x2a0 [mlx5_core]\n[...]\n\nDo not directly remove psp from the _mlx5e_remove path, the PSP cleanup\nhappens as part of profile cleanup."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/mlx5e: Evitar desregistrar PSP dos veces\n\nPSP se desregistra dos veces en:\n_mlx5e_remove -> mlx5e_psp_unregister\nmlx5e_nic_cleanup -> mlx5e_psp_unregister\n\nEsto conduce a un refcount underflow en algunas condiciones:\n------------[ corte aquí ]------------\nrefcount_t: underflow; uso después de liberación.\nADVERTENCIA: CPU: 2 PID: 1694 en lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0\n[...]\n mlx5e_psp_unregister+0x26/0x50 [mlx5_core]\n mlx5e_nic_cleanup+0x26/0x90 [mlx5_core]\n mlx5e_remove+0xe6/0x1f0 [mlx5_core]\n auxiliary_bus_remove+0x18/0x30\n device_release_driver_internal+0x194/0x1f0\n bus_remove_device+0xc6/0x130\n device_del+0x159/0x3c0\n mlx5_rescan_drivers_locked+0xbc/0x2a0 [mlx5_core]\n[...]\n\nNo eliminar directamente psp de la ruta _mlx5e_remove, la limpieza de PSP ocurre como parte de la limpieza del perfil."
    }
  ],
  "lastModified": "2026-06-17T09:59:34.517",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}