In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Avoid unregistering PSP twice
PSP is unregistered twice in: mlx5eremove -> mlx5epspunregister mlx5eniccleanup -> mlx5epspunregister
This leads to a refcount underflow in some conditions: ------------[ cut here ]------------ refcountt: underflow; use-after-free. WARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcountwarnsaturate+0xd8/0xe0 [...] mlx5epspunregister+0x26/0x50 [mlx5core] mlx5eniccleanup+0x26/0x90 [mlx5core] mlx5eremove+0xe6/0x1f0 [mlx5core] auxiliarybusremove+0x18/0x30 devicereleasedriverinternal+0x194/0x1f0 busremovedevice+0xc6/0x130 devicedel+0x159/0x3c0 mlx5rescandriverslocked+0xbc/0x2a0 [mlx5_core] [...]
Do not directly remove psp from the mlx5eremove path, the PSP cleanup happens as part of profile cleanup.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68779.json",
"cna_assigner": "Linux"
}