CVE-2025-68790

A use-after-free vulnerability was found in the Mellanox mlx5 driver in the Linux kernel. The HCA_PORTS devcom component is not cleared from device private data after being unregistered during LAG teardown. When PCI error recovery triggers two passes through mlx5_unload_one(), the second pass attempts to unregister an already-freed component, causing a use-after-free and kernel panic.

This vulnerability primarily affects s390 systems with Mellanox network adapters where PCI error recovery events trigger multiple unload passes. The issue requires specific error recovery timing conditions to manifest. While the use-after-free causes a kernel panic, the attack surface is limited to systems experiencing PCI-level errors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.