Junglewise Threat Intelligence

CVE-2025-68321: Linux Kernel log flooding in page_pool during OOM conditions

CVE-2025-68321 · Severity: high · CVSS 7.5 · Published 2025-12-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could lead to excessive system logging during low-memory conditions. When the system is under heavy network load and runs out of memory, it may generate a flood of warning messages that can impact system performance or fill up storage. This update ensures these redundant warnings are suppressed, maintaining better system stability during resource exhaustion.

Technical details

A vulnerability in the Linux kernel's page_pool allocator (net/core/page_pool.c) occurred because atomic allocations from the network datapath did not consistently include the GFP_NOWARN flag. During Out-of-Memory (OOM) conditions, network receive (Rx) operations frequently fail to allocate pages; without GFP_NOWARN, the kernel triggers verbose OOM reports for every failure. An attacker could potentially trigger these conditions via network traffic to cause a denial-of-service through log exhaustion or CPU overhead from logging. The fix ensures GFP_NOWARN is automatically added to all GFP_ATOMIC allocations within the page_pool. Patches are available in various stable kernel branches including 5.15.197, 6.1.159, 6.6.117, 6.12.58, and 6.17.8.

Affected products

  • Linux Linux Kernel 4.18 to 6.17.8

Timeline

  • 2025-12-16: advisory: Initial disclosure and NVD publication
  • 2025-12-07: patched: Fix committed to stable kernel trees

References

Related threats