Executive brief
A vulnerability in the Linux kernel's BPF subsystem could allow a local user to trigger system warnings and potentially disrupt network operations. By using specific BPF testing tools to inject malformed network packets, an attacker can cause the system to disable certain network acceleration features. This primarily impacts the reliability and performance of the networking stack on affected systems.
Technical details
A vulnerability exists in the Linux kernel's BPF subsystem where the BPF test infrastructure (specifically convert___skb_to_skb) sets gso_segs and gso_size but fails to set gso_type. When a BPF program uses bpf_clone_redirect() to push these malformed packets to a loopback device, it triggers a skb_warn_bad_offload() warning in the networking stack. This occurs because gso_features_check() detects the invalid GSO configuration, leading the kernel to disable GSO-related features for the affected traffic. The fix involves rejecting packets with unset GSO types within bpf_clone_redirect() to prevent them from reaching the wider network stack.
Affected products
- Linux Linux Kernel 850a88cc4096 to bb7902ed7d7f
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-10-20: patched: Initial patch authored by Daniel Borkmann
- 2025-12-24: advisory: CVE-2025-68725 published
References
- https://git.kernel.org/stable/c/04a899573fb87273a656f178b5f920c505f68875
- https://git.kernel.org/stable/c/0f3a60869ca22024dfb9c6fce412b0c70cb4ea36
- https://git.kernel.org/stable/c/768376ece7036ecb8604961793a1b72afe6345dd
- https://git.kernel.org/stable/c/8670b53b8ee91f028f7240531064020b7413c461
- https://git.kernel.org/stable/c/bb7902ed7d7f6d6a7c6c4dc25410d6127ce1085f
- https://git.kernel.org/stable/c/e0ffb64a2d72c6705b4a4c9efef600409f7e98a0
- https://git.kernel.org/stable/c/fbea4c63b5385588cb44ab21f91e55e33c719a54