CVE-2025-68790 in Linux
Summary
by MITRE • 01/13/2026
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix double unregister of HCA_PORTS component
Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through mlx5_unload_one() might try to unregister it again and trip over use-after-free.
On s390 almost all PCI level recovery events trigger two passes through mxl5_unload_one() - one through the poll_health() method and one through mlx5_pci_err_detected() as callback from generic PCI error recovery. While testing PCI error recovery paths with more kernel debug features enabled, this issue reproducibly led to kernel panics with the following call chain:
Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI Fault in home space mode while using kernel ASCE. AS:00000000705c4007 R3:0000000000000024 Oops: 0038 ilc:3 [#1]SMP
CPU: 14 UID: 0 PID: 156 Comm: kmcheck Kdump: loaded Not tainted 6.18.0-20251130.rc7.git0.16131a59cab1.300.fc43.s390x+debug #1 PREEMPT
Krnl PSW : 0404e00180000000 0000020fc86aa1dc (__lock_acquire+0x5c/0x15f0) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 0000020f00000001 6b6b6b6b6b6b6c33 0000000000000000 0000000000000000 0000000000000000 0000000000000001 0000000000000000 0000000000000000 0000020fca28b820 0000000000000000 0000010a1ced8100 0000010a1ced8100 0000020fc9775068 0000018fce14f8b8 0000018fce14f7f8 Krnl Code: 0000020fc86aa1cc: e3b003400004 lg %r11,832 0000020fc86aa1d2: a7840211 brc 8,0000020fc86aa5f4 *0000020fc86aa1d6: c09000df0b25 larl %r9,0000020fca28b820 >0000020fc86aa1dc: d50790002000 clc 0(8,%r9),0(%r2) 0000020fc86aa1e2: a7840209 brc 8,0000020fc86aa5f4 0000020fc86aa1e6: c0e001100401 larl %r14,0000020fca8aa9e8 0000020fc86aa1ec: c01000e25a00 larl %r1,0000020fca2f55ec 0000020fc86aa1f2: a7eb00e8 aghi %r14,232
Call Trace: __lock_acquire+0x5c/0x15f0 lock_acquire.part.0+0xf8/0x270 lock_acquire+0xb0/0x1b0 down_write+0x5a/0x250 mlx5_detach_device+0x42/0x110 [mlx5_core]
mlx5_unload_one_devl_locked+0x50/0xc0 [mlx5_core]
mlx5_unload_one+0x42/0x60 [mlx5_core]
mlx5_pci_err_detected+0x94/0x150 [mlx5_core]
zpci_event_attempt_error_recovery+0xcc/0x388
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability described in CVE-2025-68790 resides within the Linux kernel's mlx5 driver, specifically affecting the handling of Hardware Component (HCA_PORTS) during Link Aggregation Group (LAG) teardown processes on s390 architecture systems. This issue manifests as a double unregister operation that leads to use-after-free conditions, ultimately causing kernel panics and system crashes. The root cause stems from insufficient cleanup of device private data structures, where the hca_devcom_comp component is not properly cleared after its initial unregistration, allowing subsequent code paths to attempt a second unregister operation against already freed memory resources.
The technical flaw occurs during PCI error recovery scenarios where the mlx5_unload_one() function executes twice in quick succession. The first pass occurs through the poll_health() method while the second pass is triggered by the mlx5_pci_err_detected() callback from the generic PCI error recovery mechanism. This dual execution path creates a race condition where the second invocation attempts to unregister a component that has already been freed, resulting in memory corruption and subsequent kernel oops conditions. The specific memory access violation manifests as a pointer dereference in virtual kernel address space with the failing address showing clear indicators of freed memory being accessed, consistent with use-after-free patterns.
The operational impact of this vulnerability is severe, particularly in enterprise environments running on s390 systems where PCI error recovery is frequently triggered during hardware maintenance or fault conditions. The kernel panic resulting from this vulnerability leads to complete system crashes, potentially causing data loss and service disruption. The issue is exacerbated by the debugging features enabled during testing, which can make the race condition more reproducible and the system instability more pronounced. Systems experiencing this vulnerability may require manual reboot to recover, with no graceful degradation path available.
Mitigation strategies should focus on ensuring proper synchronization and state management during device teardown operations. The fix implemented involves clearing the hca_devcom_comp field in the device's private data structure immediately after unregistering it during LAG teardown, preventing subsequent code paths from attempting duplicate unregister operations. Organizations should prioritize applying the kernel patch that addresses this specific race condition, particularly in production environments where PCI error recovery scenarios are common. Additionally, system administrators should monitor for unexpected PCI errors or hardware faults that may trigger this code path, and consider implementing more robust error handling and recovery procedures to minimize the impact of such failures. This vulnerability aligns with CWE-415: Double Free and CWE-416: Use After Free, and represents a critical concern in the ATT&CK framework under the T1490: Inhibit System Recovery technique, as it can prevent proper system recovery mechanisms from functioning correctly.