CVE-2025-68363

Vulnerability

Analysis

The vulnerability resides in the Linux kernel's BPF subsystem, specifically in the bpf_skb_check_mtu helper function bpf_skb_check_mtu_check_mtu. When the BPF_MTU_CHK_SEGS flag is used, the helper relies on skb->transport_header to validate the MTU. However, the transport header is not always set, leading to a WARN_ON_ONCE splat when CONFIG_DEBUG_NET is enabled and skb->gso_size is set, particularly during bpf_prog_test_run operations [1].

Exploitation

The issue can be triggered by a BPF program that calls bpf_skb_check_mtu with the BPF_MTU_CHK_SEGS flag on a socket buffer where the transport header has not been initialized. While the warning is limited to test environments with CONFIG_DEBUG_NET enabled, the underlying condition could be reached in production if a crafted packet or BPF program causes the helper to access an uninitialized transport header. The attack surface. The fix adds a check using skb_transport_header_was_set() before using the transport header, preventing the warning and potential undefined behavior [2].

Impact

An attacker with the ability to load and execute BPF programs (requiring CAP_BPF or root privileges) could trigger a kernel warning, potentially leading to a denial of service if the system is configured to panic on warnings. The impact is limited to systems with CONFIG_DEBUG_NET enabled, but the fix ensures robustness even without that configuration.

Mitigation

The vulnerability is patched in the Linux kernel stable tree. The commit [1] and [2] address the issue by adding a check for skb_transport_header_was_set() before accessing the transport header. Users should apply the latest kernel updates to mitigate this issue.