CVE-2025-68787

CVE-2025-68787 is a memory leak vulnerability in the Linux kernel's NET/ROM protocol implementation, specifically in the nr_sendmsg() function in net/netrom/af_netrom.c. When nr_output() calls sock_alloc_send_skb() and it returns NULL, the original skb allocated in nr_sendmsg() is not freed, leading to a memory leak [1]. The issue was reported by syzbot and is tracked in the kernel's bug tracking system.

Exploitation

The vulnerability can be triggered by a local user with the ability to send messages over a NET/ROM socket. By causing sock_alloc_send_skb() to fail (e.g., due to memory pressure or flag manipulation), an attacker can repeatedly leak skbs without freeing them, slowly exhausting kernel memory. No special privileges are required beyond the ability to open and write to a NET/ROM socket.

Impact

An attacker can cause a gradual depletion of kernel memory, potentially leading to a denial of service (system hang or crash) if the system runs out of memory. The leak is per nr_sendmsg() call, and with repeated exploitation the system memory can be exhausted, affecting all processes on the host.

Mitigation

The fix is included in Linux kernel stable tree commits [1][2][3]. The patch adds a kfree_skb(skb) before returning an error in nr_sendmsg() when nr_output() fails due to sock_alloc_send_skb() returning NULL. Users should update their kernel to a patched version (e.g., 6.12-stable or later). If patching is not possible, restricting local access to NET/ROM sockets may reduce risk, but no complete workaround is available.