Linux kernel mlxsw: use-after-free updating multicast route stats during route replace

Impact

The mlxsw driver for Mellanox Spectrum switch ASICs deletes a multicast route list entry during route replace without taking the mutex that protects the list, while a workqueue periodically walks that list to pull stats from the device. KASAN shows a slab-use-after-free in mlxsw_sp_mr_stats_update. This is switch-side code: it runs on Spectrum-based datacenter switches and on hosts running the mlxsw driver, not on a GPU compute node. The practical outcome is a kernel crash on the switch control plane, which takes down a leaf or spine in the fabric that the fleet depends on; the record gives no evidence of controlled exploitation, and triggering it requires control over multicast routing configuration.

Who can reach it

Local on the switch control plane - an operator or process able to change IPv4/IPv6 multicast routes (route replace) on a device running mlxsw. Not reachable from a tenant workload on a GPU node.

What to do

Update the switch OS / host kernel to a build containing the mlxsw spectrum_mr locking fix (commits in the record) and reboot the switch control plane, which means draining traffic to the redundant path in the fabric first. No workaround is given; avoiding multicast route replacement reduces exposure but is not a stated mitigation.

References

Related entries

• Linux kernel mlxsw (Spectrum switch router, neighbour table): The driver stored neighbour pointers without holdingCVE-2025-68801 · Linux kernel mlxsw (Spectrum switch router, neighbour table)High
• Linux bnxt_re RoCE driver (bnxt_re_copy_err_stats out-of-bounds write): Out-of-bounds write in the Broadcom RoCECVE-2025-71092 · Linux bnxt_re RoCE driver (bnxt_re_copy_err_stats out-of-bounds write)High
• Linux kernel InfiniBand user MAD interface (ib_umad, /dev/infiniband/umad*): A process with access to the user MADCVE-2026-23243 · Linux kernel InfiniBand user MAD interface (ib_umad, /dev/infiniband/umad*)High
• Dell iDRAC Service Module (iSM) for Windows and Linux: Improper access control in the host-side iDRAC Service ModuleCVE-2026-23856 · Dell iDRAC Service Module (iSM) for Windows and LinuxHigh
• Linux kernel irdma: failed memory-region re-registration leaves a stale umem, leading to double freeCVE-2026-43120 · Linux kernel RDMA/irdma (rereg_user_mr memory-region re-registration)High
• Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region failsCVE-2026-43128 · Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path)High