Executive brief
A vulnerability was identified in the Linux kernel's Samsung 10Gb Ethernet driver (sxgbe). The driver incorrectly handles certain network data reception scenarios, which can lead to a system crash (kernel panic). This could allow a remote attacker to disrupt network connectivity or cause a denial-of-service on affected systems.
Technical details
A NULL pointer dereference exists in the sxgbe_rx() function within drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c. The vulnerability occurs when the driver encounters a NULL socket buffer (skb) pointer; it logs an error but continues to dereference the pointer on the subsequent line during a prefetch operation. An attacker could potentially trigger this condition via network traffic, leading to a kernel panic. The fix introduces a break statement to properly exit the loop and switch to the refill routine when a NULL descriptor is encountered. Patches have been released for multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, and 6.12.
Affected products
- Linux Linux Kernel 3.15 to 6.12.61
Timeline
- 2025-11-21: disclosed: Vulnerability identified during code review and patch submitted.
- 2025-12-07: patched: Patch committed to stable kernel trees.
- 2025-12-16: advisory: CVE-2025-68302 published.
References
- https://git.kernel.org/stable/c/18ef3ad1bb57dcf1a9ee61736039aedccf670b21
- https://git.kernel.org/stable/c/45b5b4ddb8d6bea5fc1625ff6f163bbb125d49cc
- https://git.kernel.org/stable/c/46e5332126596a2ca791140feab18ce1fc1a3c86
- https://git.kernel.org/stable/c/7fd789d6ea4915034eb6bcb72f6883c8151083e5
- https://git.kernel.org/stable/c/88f46c0be77bfe45830ac33102c75be7c34ac3f3
- https://git.kernel.org/stable/c/ac171c3c755499c9f87fe30b920602255f8b5648
- https://git.kernel.org/stable/c/f5bce28f6b9125502abec4a67d68eabcd24b3b17