---
id: CVE-2025-68801
title: 'mlxsw: spectrum_router: Fix neighbour use-after-free'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mlxsw: spectrum_router: Fix neighbour use-after-free

  We sometimes observe use-after-free when dereferencing a neighbour [1].
  The problem seems to be that the driver st…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    a2dfe6758fc63e542105bee8b17a3a7485684db0
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    9e0a0d9eeb0dbeba2c83fa837885b19b8b9230fc
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    c437fbfd4382412598cdda1f8e2881b523668cc2
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    4a3c569005f42ab5e5b2ad637132a33bf102cc08
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    ed8141b206bdcfd5d0b92c90832eeb77b7a60a0a
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    675c5aeadf6472672c472dc0f26401e4fcfbf254
  - >-
    Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de <
    8b0e69763ef948fb872a7767df4be665d18f5fd4
  - Linux 4.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:05:21.829197Z'
published: '2026-01-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:45.120Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-68801'
references:
  - url: 'https://git.kernel.org/stable/c/a2dfe6758fc63e542105bee8b17a3a7485684db0'
  - url: 'https://git.kernel.org/stable/c/9e0a0d9eeb0dbeba2c83fa837885b19b8b9230fc'
  - url: 'https://git.kernel.org/stable/c/c437fbfd4382412598cdda1f8e2881b523668cc2'
  - url: 'https://git.kernel.org/stable/c/4a3c569005f42ab5e5b2ad637132a33bf102cc08'
  - url: 'https://git.kernel.org/stable/c/ed8141b206bdcfd5d0b92c90832eeb77b7a60a0a'
  - url: 'https://git.kernel.org/stable/c/675c5aeadf6472672c472dc0f26401e4fcfbf254'
  - url: 'https://git.kernel.org/stable/c/8b0e69763ef948fb872a7767df4be665d18f5fd4'
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.03809
ingestedAt: '2026-10-16T17:24:46.634Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mlxsw: spectrum_router: Fix neighbour use-after-free

We sometimes observe use-after-free when dereferencing a neighbour [1].
The problem seems to be that the driver stores a pointer to the
neighbour, but without holding a reference on it. A reference is only
taken when the neighbour is used by a nexthop.

Fix by simplifying the reference counting scheme. Always take a
reference when storing a neighbour pointer in a neighbour entry. Avoid
taking a referencing when the neighbour is used by a nexthop as the
neighbour entry associated with the nexthop already holds a reference.

Tested by running the test that uncovered the problem over 300 times.
Without this patch the problem was reproduced after a handful of
iterations.

[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_neigh_entry_update+0x2d4/0x310
Read of size 8 at addr ffff88817f8e3420 by task ip/3929

CPU: 3 UID: 0 PID: 3929 Comm: ip Not tainted 6.18.0-rc4-virtme-g36b21a067510 #3 PREEMPT(full)
Hardware name: Nvidia SN5600/VMOD0013, BIOS 5.13 05/31/2023
Call Trace:
 <TASK>
 dump_stack_lvl+0x6f/0xa0
 print_address_description.constprop.0+0x6e/0x300
 print_report+0xfc/0x1fb
 kasan_report+0xe4/0x110
 mlxsw_sp_neigh_entry_update+0x2d4/0x310
 mlxsw_sp_router_rif_gone_sync+0x35f/0x510
 mlxsw_sp_rif_destroy+0x1ea/0x730
 mlxsw_sp_inetaddr_port_vlan_event+0xa1/0x1b0
 __mlxsw_sp_inetaddr_lag_event+0xcc/0x130
 __mlxsw_sp_inetaddr_event+0xf5/0x3c0
 mlxsw_sp_router_netdevice_event+0x1015/0x1580
 notifier_call_chain+0xcc/0x150
 call_netdevice_notifiers_info+0x7e/0x100
 __netdev_upper_dev_unlink+0x10b/0x210
 netdev_upper_dev_unlink+0x79/0xa0
 vrf_del_slave+0x18/0x50
 do_set_master+0x146/0x7d0
 do_setlink.isra.0+0x9a0/0x2880
 rtnl_newlink+0x637/0xb20
 rtnetlink_rcv_msg+0x6fe/0xb90
 netlink_rcv_skb+0x123/0x380
 netlink_unicast+0x4a3/0x770
 netlink_sendmsg+0x75b/0xc90
 __sock_sendmsg+0xbe/0x160
 ____sys_sendmsg+0x5b2/0x7d0
 ___sys_sendmsg+0xfd/0x180
 __sys_sendmsg+0x124/0x1c0
 do_syscall_64+0xbb/0xfd0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[...]

Allocated by task 109:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 __kasan_kmalloc+0x7b/0x90
 __kmalloc_noprof+0x2c1/0x790
 neigh_alloc+0x6af/0x8f0
 ___neigh_create+0x63/0xe90
 mlxsw_sp_nexthop_neigh_init+0x430/0x7e0
 mlxsw_sp_nexthop_type_init+0x212/0x960
 mlxsw_sp_nexthop6_group_info_init.constprop.0+0x81f/0x1280
 mlxsw_sp_nexthop6_group_get+0x392/0x6a0
 mlxsw_sp_fib6_entry_create+0x46a/0xfd0
 mlxsw_sp_router_fib6_replace+0x1ed/0x5f0
 mlxsw_sp_router_fib6_event_work+0x10a/0x2a0
 process_one_work+0xd57/0x1390
 worker_thread+0x4d6/0xd40
 kthread+0x355/0x5b0
 ret_from_fork+0x1d4/0x270
 ret_from_fork_asm+0x11/0x20

Freed by task 154:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 __kasan_save_free_info+0x3b/0x60
 __kasan_slab_free+0x43/0x70
 kmem_cache_free_bulk.part.0+0x1eb/0x5e0
 kvfree_rcu_bulk+0x1f2/0x260
 kfree_rcu_work+0x130/0x1b0
 process_one_work+0xd57/0x1390
 worker_thread+0x4d6/0xd40
 kthread+0x355/0x5b0
 ret_from_fork+0x1d4/0x270
 ret_from_fork_asm+0x11/0x20

Last potentially related work creation:
 kasan_save_stack+0x30/0x50
 kasan_record_aux_stack+0x8c/0xa0
 kvfree_call_rcu+0x93/0x5b0
 mlxsw_sp_router_neigh_event_work+0x67d/0x860
 process_one_work+0xd57/0x1390
 worker_thread+0x4d6/0xd40
 kthread+0x355/0x5b0
 ret_from_fork+0x1d4/0x270
 ret_from_fork_asm+0x11/0x20

## Affected

- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < a2dfe6758fc63e542105bee8b17a3a7485684db0`
- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < 9e0a0d9eeb0dbeba2c83fa837885b19b8b9230fc`
- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < c437fbfd4382412598cdda1f8e2881b523668cc2`
- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < 4a3c569005f42ab5e5b2ad637132a33bf102cc08`
- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < ed8141b206bdcfd5d0b92c90832eeb77b7a60a0a`
- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < 675c5aeadf6472672c472dc0f26401e4fcfbf254`
- `Linux >= 6cf3c971dc84cb36579515ddb488919b9e9fb6de < 8b0e69763ef948fb872a7767df4be665d18f5fd4`
- `Linux 4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.