The Linux kernel's mlxsw spectrum_router driver had a use-after-free vulnerability due to improper reference counting of neighbour pointers. The driver stored neighbour pointers without holding references unless used by a nexthop, which sometimes led to dereferencing freed memory. The patch fixes this by always taking a reference when storing a neighbour pointer in a neighbour entry and removing redundant references when used by a nexthop. The fix was validated by repeated testing that previously reproduced the issue within a few iterations.

This vulnerability allows local attackers with limited privileges to cause use-after-free conditions in kernel memory, potentially leading to kernel crashes or escalation of privileges due to memory corruption. The CVSS vector indicates local attack vector with low complexity, requiring privileges, and no user interaction, with high impact on confidentiality, integrity, and availability.

A fix for this vulnerability has been implemented in the Linux kernel by correcting the reference counting in the mlxsw spectrum_router driver. Users should update to a kernel version that includes this patch. Since no explicit patch links or fixed versions are provided, check the official Linux kernel advisories or vendor updates for the fixed kernel version. Patch status is not yet confirmed in this data — verify with vendor advisories for current remediation guidance.