CVE-2025-68339

Root

Cause

The fore200e_open() function in the Linux kernel's ATM Fore 200e driver correctly acquires the rate_mtx lock when subtracting the new VCC's max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the error restoration path adds the value back to available_cell_rate without taking the lock. The field available_cell_rate is a shared device resource concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos() [description].

Exploitation and

Attack Surface

The race can be triggered when an error occurs in fore200e_open() returning from a failed fore200e_activate_vcin() call. If another CPU simultaneously executes fore200e_close() or fore200e_change_qos() for a different VCC and holds rate_mtx, the lock-free read-modify-write in the error path will read a stale value and then overwrite the legitimate update made under the lock. This is a classic TOCTOU (time-of-check-time-of-use) race on the shared variable.

Impact

A successful race results in incorrect bandwidth accounting for the ATM device. available_cell_rate may become inaccurate (e.g., too high or too low), potentially allowing further VCC openings to exceed limits or preventing legitimate VCCs from obtaining the bandwidth they need. In extreme cases, this could lead to denial of service or incorrect QoS enforcement.

Mitigation

Status

The fix has been applied in the stable kernel tree as commit ed34c70d88e2 [1], with additional backports also available [2][3][4]. Users should update their Linux kernel to a version containing these patches. No workaround is available other than applying the kernel fix.