CVE-2025-68200

Vulnerability

A vulnerability exists in the Linux kernel's BPF and net/sched subsystems where the cls_bpf_classify() function can modify the drop_reason field in tc_skb_cb. This field was introduced to track the reason for dropping packets, but when a BPF program is executed via cls_bpf_classify(), it writes BPF's data pointers (data_meta/data_end) into the same storage area that holds the drop_reason, corrupting it. This leads to a kernel warning in sk_skb_reason_drop().

Exploitation

An attacker who can attach a BPF program to a tc classifier (requires CAP_NET_ADMIN) can trigger this issue by sending packets that cause the BPF program to run. No other authentication is needed. The bug was discovered by syzbot, indicating it can be triggered without special privileges beyond the ability to configure BPF programs.

Impact

When the corrupted drop_reason is used, a warning is generated: WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop. This results in a kernel panic or at least a denial of service due to the warning. There is no evidence of code execution beyond this warning.

Mitigation

The fix is committed in Linux kernel stable branches as patches [1][2]. The commit introduces bpf_prog_run_data_pointers() to save and restore the net_sched storage that collides with BPF data pointers. Users should apply the latest kernel updates to mitigate the issue.