The Linux kernel's mlxsw spectrum_mr driver had a use-after-free vulnerability (CVE-2025-68800) due to a missing mutex lock when deleting entries from the multicast route list during route replacement. This could cause the driver to access freed memory while updating multicast route statistics, leading to kernel memory corruption. The vulnerability was resolved by introducing a dedicated mutex to protect the multicast route list, ensuring safe traversal and modification. The issue was identified through kernel address sanitizer (KASAN) reports and fixed in kernel version 6.18.0-rc1-custom and later.

This vulnerability allows a local attacker with limited privileges to cause use-after-free conditions in kernel memory, potentially leading to arbitrary code execution, system crashes, or denial of service. The CVSS vector indicates high impact on confidentiality, integrity, and availability. Exploitation requires local access and privileges, but successful exploitation could compromise system stability and security.

A fix has been implemented in the Linux kernel by adding a dedicated mutex to protect the multicast route list during updates. Users should update to the fixed kernel version that includes this patch. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation. Patch status is not explicitly stated in the input, so users should consult their Linux distribution or kernel vendor advisory for the exact fixed version and update accordingly.