CVE-2025-68241
BaseFortify
Publication date: 2025-12-16
Last updated on: 2025-12-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves a race condition in the sit driver's packet transmission path. Specifically, the function rt_bind_exception() can rebind a stale fnhe (forwarding next hop entry) after it has been selected for deletion but before it is freed. This leads to a device reference count leak and warnings when unregistering the network device, as the stale fnhe is reused and bound to a new destination while the original is being freed.
How can this vulnerability impact me? :
The vulnerability causes a device reference count leak, which can result in resource leaks and warnings in system logs (dmesg) when network devices are unregistered. This may lead to increased memory usage and potential instability in network device management.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing warnings in the system logs, specifically dmesg messages such as 'unregister_netdevice: waiting for sitX to become free. Usage count = N', which indicate a device reference count leak. Additionally, a simple test validation method involves creating a network namespace and running specific ip and mausezahn commands as follows: ip netns add ns1 ip -n ns1 link set dev lo up ip -n ns1 address add 192.0.2.1/32 dev lo ip -n ns1 link add name dummy1 up type dummy ip -n ns1 route add 192.0.2.2/32 dev dummy1 ip -n ns1 link add name gretap1 up arp off type gretap local 192.0.2.1 remote 192.0.2.2 ip -n ns1 route add 198.51.0.0/16 dev gretap1 taskset -c 0 ip netns exec ns1 mausezahn gretap1 -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & taskset -c 2 ip netns exec ns1 mausezahn gretap1 -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & sleep 10 ip netns pids ns1 | xargs kill ip netns del ns1
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the fix that clears the 'oldest->fnhe_daddr' field before calling fnhe_flush_routes(), which prevents the stale fnhe from being reused and bound to a new destination just before it is freed. Practically, this means updating the Linux kernel to a version where this vulnerability is resolved.