CVE-2025-68801

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_router: Fix neighbour use-after-free

We sometimes observe use-after-free when dereferencing a neighbour [1].

The problem seems to be that the driver stores a pointer to the

neighbour, but without holding a reference on it. A reference is only

taken when the neighbour is used by a nexthop.

Fix by simplifying the reference counting scheme. Always take a

reference when storing a neighbour pointer in a neighbour entry. Avoid

taking a referencing when the neighbour is used by a nexthop as the

neighbour entry associated with the nexthop already holds a reference.

Tested by running the test that uncovered the problem over 300 times.

Without this patch the problem was reproduced after a handful of

iterations.

[1]

BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310

Read of size 8 at addr ffff88817f8e3420 by task ip/3929

CPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References