CVE-2025-68790
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in…
Overview
CVE-2025-68790 is a known-severity vulnerability. It was published on January 13, 2026.
Technical description
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix double unregister of HCA_PORTS component
Clear hca_devcom_comp in device's private data after unregistering it in
LAG teardown. Otherwise a slightly lagging second pass through
mlx5_unload_one() might try to unregister it again and trip over
use-after-free.
On s390 almost all PCI level recovery events trigger two passes through
mxl5_unload_one() - one through the poll_health() method and one through
mlx5_pci_err_detected() as callback from generic PCI error recovery.
While testing PCI error recovery paths with more kernel debug features
enabled, this issue reproducibly led to kernel panics with the following
call chain:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI
Fault in home space mode while using kernel ASCE.
AS:00000000705c4007 R3:0000000000000024
Oops: 0038 ilc:3 [#1]SMP
CPU: 14 UID: 0 PID:
Remediation
Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2025-68790?
CVE-2025-68790 is a known-severity vulnerability. It was published on January 13, 2026.
How severe is CVE-2025-68790?
CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.
How do I fix or remediate CVE-2025-68790?
Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2025-68790?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2025-68790 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.