Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-68768— inet: frags: flush pending skbs in fqdir_pre_exit()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于fqdir_pre_exit()中未刷新待处理的skb，可能导致死锁。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.20% · P9

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux d5dd88794a13c2f24cce31abad7a0a6c5e0ed2db< 22ee4010866da81aeee08e1ea3fddbe418feb212 affected
d5dd88794a13c2f24cce31abad7a0a6c5e0ed2db< 543555954b1ee8d1903a7020324efb41b0c97428 affected
d5dd88794a13c2f24cce31abad7a0a6c5e0ed2db< c70df25214ac9b32b53e18e6ae3b8f073ffa6903 affected
d5dd88794a13c2f24cce31abad7a0a6c5e0ed2db< 006a5035b495dec008805df249f92c22c89c3d2e affected
5.3 affected
< 5.3 unaffected
6.6.143≤ 6.6.* unaffected
6.12.93≤ 6.12.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-68768

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
inet: frags: flush pending skbs in fqdir_pre_exit()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlocks on pernet_ops_rwsem since September in NIPA. The stuck task was usually modprobe (often loading a driver like ipvlan), trying to take the lock as a Writer. lockdep does not track readers for rwsems so the read wasn't obvious from the reports. On closer inspection the Reader holding the lock was conntrack looping forever in nf_conntrack_cleanup_net_list(). Based on past experience with occasional NIPA crashes I looked thru the tests which run before the crash and noticed that the crash follows ip_defrag.sh. An immediate red flag. Scouring thru (de)fragmentation queues reveals skbs sitting around, holding conntrack references. The problem is that since conntrack depends on nf_defrag_ipv6, nf_defrag_ipv6 will load first. Since nf_defrag_ipv6 loads first its netns exit hooks run _after_ conntrack's netns exit hook. Flush all fragment queue SKBs during fqdir_pre_exit() to release conntrack references before conntrack cleanup runs. Also flush the queues in timer expiry handlers when they discover fqdir->dead is set, in case packet sneaks in while we're running the pre_exit flush. The commit under Fixes is not exactly the culprit, but I think previously the timer firing would eventually unblock the spinning conntrack.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于fqdir_pre_exit()中未刷新待处理的skb，可能导致死锁。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d5dd88794a13c2f24cce31abad7a0a6c5e0ed2db ~ 22ee4010866da81aeee08e1ea3fddbe418feb212 -
Linux Linux 5.3 -

II. Public POCs for CVE-2025-68768

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-68768

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-68768 (2)

Same Patch Batch · Linux · 2026-01-13 · 93 CVEs total

CVE-2025-68811 9.8 CRITICAL svcrdma: use rc_pageoff for memcpy byte offset
CVE-2025-68794 9.8 CRITICAL iomap: adjust read range correctly for non-block-aligned positions
CVE-2025-68817 9.8 CRITICAL ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency
CVE-2025-68775 9.8 CRITICAL net/handshake: duplicate handshake cancellations leak socket
CVE-2025-71068 9.8 CRITICAL svcrdma: bound check rq_pages index in inline path
CVE-2025-68809 9.1 CRITICAL ksmbd: vfs: fix race on m_flags in vfs_cache
CVE-2025-71093 9.1 CRITICAL e1000: fix OOB in e1000_tbi_should_accept()
CVE-2025-71095 9.1 CRITICAL net: stmmac: fix the crash issue for zero copy XDP_TX action
CVE-2025-68818 8.8 HIGH scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"
CVE-2025-71072 8.2 HIGH shmem: fix recovery on rename failures
CVE-2025-68799 8.1 HIGH caif: fix integer underflow in cffrml_receive()
CVE-2025-68803 8.0 HIGH NFSD: NFSv4 file creation neglects setting ACL
CVE-2025-68795 7.8 HIGH ethtool: Avoid overflowing userspace buffer on stats query
CVE-2025-68808 7.8 HIGH media: vidtv: initialize local pointers upon transfer of memory ownership
CVE-2025-68792 7.8 HIGH tpm2-sessions: Fix out of range indexing in name_size
CVE-2025-68793 7.8 HIGH drm/amdgpu: fix a job->pasid access race in gpu recovery
CVE-2025-68805 7.8 HIGH fuse: fix io-uring list corruption for terminated non-committed requests
CVE-2025-68815 7.8 HIGH net/sched: ets: Remove drr class from the active list if it changes to strict
CVE-2025-68801 7.8 HIGH mlxsw: spectrum_router: Fix neighbour use-after-free
CVE-2025-71082 7.8 HIGH Bluetooth: btusb: revert use of devm_kzalloc in btusb

Showing top 20 of 93 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-68768

No comments yet

Leave a comment