CVE-2025-68779

net/mlx5e: Avoid unregistering PSP twice

published January 13, 2026

CVSS
—
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Avoid unregistering PSP twice

PSP is unregistered twice in:

_mlx5e_remove -> mlx5e_psp_unregister

mlx5e_nic_cleanup -> mlx5e_psp_unregister

This leads to a refcount underflow in some conditions:

------------[ cut here ]------------

refcount_t: underflow; use-after-free.

WARNING: CPU: 2 PID: 1694 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0

[...]

mlx5e_psp_unregister+0x26/0x50 [mlx5_core]

mlx5e_nic_cleanup+0x26/0x90 [mlx5_core]

mlx5e_remove+0xe6/0x1f0 [mlx5_core]

auxiliary_bus_remove+0x18/0x30

device_release_driver_internal+0x194/0x1f0

bus_remove_device+0xc6/0x130

device_del+0x159/0x3c0

mlx5_rescan_drivers_locked+0xbc/0x2a0 [mlx5_core]

[...]

Do not directly remove psp from the _mlx5e_remove path, the PSP cleanup

happens as part of profile cleanup.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00186 · 7.8th percentile
Published
2026-01-13T15:28Z
EPSS history
Timeline
  • 13 JAN 15:28Z
    net/mlx5e: Avoid unregistering PSP twice
    cvelistv5