Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-68725— bpf: Do not let BPF test infra emit invalid GSO types to stack

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未设置gso_type，可能导致无效GSO类型被发送到堆栈。

AI Predicted 5.5 Difficulty: Hard EPSS 0.18% · P8

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 850a88cc4096fe1df407452ba2e4d28cf5b3eee9< bb7902ed7d7f6d6a7c6c4dc25410d6127ce1085f affected
850a88cc4096fe1df407452ba2e4d28cf5b3eee9< e0ffb64a2d72c6705b4a4c9efef600409f7e98a0 affected
850a88cc4096fe1df407452ba2e4d28cf5b3eee9< 768376ece7036ecb8604961793a1b72afe6345dd affected
850a88cc4096fe1df407452ba2e4d28cf5b3eee9< 8670b53b8ee91f028f7240531064020b7413c461 affected
850a88cc4096fe1df407452ba2e4d28cf5b3eee9< 0f3a60869ca22024dfb9c6fce412b0c70cb4ea36 affected
850a88cc4096fe1df407452ba2e4d28cf5b3eee9< fbea4c63b5385588cb44ab21f91e55e33c719a54 affected
850a88cc4096fe1df407452ba2e4d28cf5b3eee9< 04a899573fb87273a656f178b5f920c505f68875 affected
5.6 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-68725

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf: Do not let BPF test infra emit invalid GSO types to stack
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not let BPF test infra emit invalid GSO types to stack Yinhao et al. reported that their fuzzer tool was able to trigger a skb_warn_bad_offload() from netif_skb_features() -> gso_features_check(). When a BPF program - triggered via BPF test infra - pushes the packet to the loopback device via bpf_clone_redirect() then mentioned offload warning can be seen. GSO-related features are then rightfully disabled. We get into this situation due to convert___skb_to_skb() setting gso_segs and gso_size but not gso_type. Technically, it makes sense that this warning triggers since the GSO properties are malformed due to the gso_type. Potentially, the gso_type could be marked non-trustworthy through setting it at least to SKB_GSO_DODGY without any other specific assumptions, but that also feels wrong given we should not go further into the GSO engine in the first place. The checks were added in 121d57af308d ("gso: validate gso_type in GSO handlers") because there were malicious (syzbot) senders that combine a protocol with a non-matching gso_type. If we would want to drop such packets, gso_features_check() currently only returns feature flags via netif_skb_features(), so one location for potentially dropping such skbs could be validate_xmit_unreadable_skb(), but then otoh it would be an additional check in the fast-path for a very corner case. Given bpf_clone_redirect() is the only place where BPF test infra could emit such packets, lets reject them right there.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未设置gso_type，可能导致无效GSO类型被发送到堆栈。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 850a88cc4096fe1df407452ba2e4d28cf5b3eee9 ~ bb7902ed7d7f6d6a7c6c4dc25410d6127ce1085f -
Linux Linux 5.6 -

II. Public POCs for CVE-2025-68725

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-68725

请登录查看更多情报信息。

Other References for CVE-2025-68725 (1)

Same Patch Batch · Linux · 2025-12-24 · 322 CVEs total

CVE-2025-68741 9.8 CRITICAL scsi: qla2xxx: Fix improper freeing of purex item
CVE-2025-68745 9.8 CRITICAL scsi: qla2xxx: Clear cmds after chip reset
CVE-2022-50717 9.8 CRITICAL nvmet-tcp: add bounds check on Transfer Tag
CVE-2023-54090 9.8 CRITICAL ixgbe: Fix panic during XDP_TX with > 64 CPUs
CVE-2023-54094 9.8 CRITICAL net: prevent skb corruption on frag list segmentation
CVE-2023-53867 9.8 CRITICAL ceph: fix potential use-after-free bug when trimming caps
CVE-2025-68359 9.8 CRITICAL btrfs: fix double free of qgroup record after failure to add delayed ref head
CVE-2025-68726 9.8 CRITICAL crypto: aead - Fix reqsize handling
CVE-2023-54076 9.8 CRITICAL smb: client: fix missed ses refcounting
CVE-2023-53996 9.3 CRITICAL x86/sev: Make enc_dec_hypercall() accept a size instead of npages
CVE-2023-54071 8.8 HIGH wifi: rtw88: use work to update rate to avoid RCU warning
CVE-2025-68736 8.8 HIGH landlock: Fix handling of disconnected directories
CVE-2023-54040 8.8 HIGH ice: fix wrong fallback logic for FDIR
CVE-2023-54092 8.8 HIGH KVM: s390: pv: fix index value of replaced ASCE
CVE-2022-50732 8.8 HIGH staging: rtl8192u: Fix use after free in ieee80211_rx()
CVE-2023-54043 8.8 HIGH iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
CVE-2023-54120 8.8 HIGH Bluetooth: Fix race condition in hidp_session_thread
CVE-2023-54060 8.8 HIGH iommufd: Set end correctly when doing batch carry
CVE-2023-53986 8.6 HIGH mips: bmips: BCM6358: disable RAC flush for TP1
CVE-2022-50746 8.4 HIGH erofs: validate the extent length for uncompressed pclusters

Showing top 20 of 322 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-68725

No comments yet

Leave a comment