CVE-2025-68799

Vulnerability

The Linux kernel's CAIF (CA Interface) protocol implementation contains an integer underflow vulnerability in the cffrml_receive() function. When Frame Check Sequence (FCS) is disabled, the function subtracts 2 from a length field extracted from the packet header without first verifying that the length is at least 2. This flaw was introduced in the CAIF subsystem and affects the kernel's handling of CAIF frames [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted CAIF packet with a length field set to 0 or 1 to an interface that has FCS disabled. The missing validation causes an integer underflow when subtracting 2, resulting in a very large length value. This can lead to memory exhaustion as the kernel attempts to allocate or process an oversized buffer, and may also cause kernel instability [1][2].

Impact

Successful exploitation can lead to denial of service through memory exhaustion and kernel instability. Additionally, if padding data is involved, the underflow could potentially cause information disclosure by exposing uninitialized kernel memory. The vulnerability does not require authentication, but does require the ability to send CAIF frames to a CAIF interface with FCS disabled [1][2].

Mitigation

The fix has been applied in the Linux kernel stable tree via commits 785c7be63616 and 8a11ff0948b. Users should update to a kernel version containing these patches. No workaround is available other than disabling CAIF or ensuring FCS is enabled on all CAIF interfaces [1][2].