CVE-2025-68241

Vulnerability

CVE-2025-68241 describes a race condition in the Linux kernel's IPv4 routing subsystem. The fnhe_remove_oldest() function, called during update_or_create_fnhe() from the SIT (Simple Internet Transition) tunnel transmit path (e.g., sit_tunnel_xmit()), selects a cached next-hop exception (fnhe) entry for deletion. A race window exists between when an entry is selected for removal and when it is actually freed via RCU: a concurrent __mkroute_output() → find_exception() can access the soon-to-be-deleted entry, and rt_bind_exception() then binds it to a new dst with a dst_hold(). When the original fnhe is finally freed by the RCU callback, the corresponding dst reference remains permanently leaked [1][2][3][4].

Exploitation

Attackers require the ability to generate high-rate UDP traffic through a SIT/gretap tunnel configured in a network namespace, as demonstrated by Ido Schimmel's test using mausezahn [1]. No special privileges beyond local user access to create the described tunnel configuration are needed; the race is triggered by normal packet processing under load. The fnhe_remove_oldest() is invoked when the number of cached exceptions exceeds FNHE_RECLAIM_DEPTH + random, so sustained traffic that triggers new route entries is sufficient.

Impact

Successful exploitation results in a reference count leak on the network device associated with the tunnel interface. This is visible in kernel logs as a warning during device unregistration:

unregister_netdevice: waiting for sitX to become free. Usage count = N

The leaked reference prevents the tunnel interface from being fully cleaned up, potentially leading to resource exhaustion or a denial of service on the affected system.

Mitigation

The fix, applied in stable kernel branches, clears oldest->fnhe_daddr before calling fnhe_flush_routes(). Since rt_bind_exception() checks the fnhe_daddr field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed [1][2][3][4]. Administrators should apply the latest kernel updates or backport the relevant commits to resolve the issue.