CVE-2025-68191

Root

Cause

The Linux kernel function udp_tunnel_nic_register() used netdev_WARN() to log errors when memory allocation (via kzalloc() or udp_tunnel_nic_alloc()) failed. netdev_WARN() triggers a WARN_ON backtrace, which is intended for kernel bugs, not routine runtime errors like memory exhaustion. This mismatch caused unnecessary kernel bug reports ([1]).

Exploitation

An attacker with the ability to exhaust memory on a system can trigger this warning by causing udp_tunnel_nic_register() to fail. No special privileges are required beyond the ability to induce memory pressure. The WARN_ON can lead to system instability (e.g., panic on some configurations) or excessive log flooding.

Impact

The primary impact is a denial-of-service condition: repeated WARN_ON calls can degrade system performance, fill logs, or cause a kernel panic depending on the kernel configuration. The information leak is minimal since the backtrace reveals kernel addresses but not sensitive data.

Mitigation

The fix replaces netdev_WARN() with netdev_warn(), which logs a warning without triggering a kernel bug splat. The patch has been backported to multiple stable kernel trees as referenced in [1]. Users should apply the latest stable updates to eliminate the risk.