Junglewise Threat Intelligence

CVE-2025-68776: Linux Kernel NULL pointer dereference in net/hsr

CVE-2025-68776 · Severity: info · CVSS 0 · Published 2026-01-13

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking component responsible for High-availability Seamless Redundancy (HSR) and Parallel Redundancy Protocol (PRP). These protocols are typically used in industrial automation and critical infrastructure to ensure network reliability. An exploit could cause the system to crash (denial of service) when it fails to allocate memory for incoming network traffic, potentially disrupting industrial operations or safety systems.

Technical details

A NULL pointer dereference vulnerability exists in the prp_get_untagged_frame() function within the net/hsr/hsr_forward.c component of the Linux kernel. The root cause is a missing check for the return value of __pskb_copy(); when this function fails to allocate memory and returns NULL, a subsequent call to skb_clone() dereferences the NULL pointer, leading to a general protection fault and system crash. This can be triggered by incoming PRP network frames during periods of memory exhaustion. The issue has been patched in multiple stable kernel branches by adding the necessary NULL check.

Affected products

  • Linux Linux Kernel f266a683a480 and later
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-11-29: disclosed: Vulnerability reported and patch authored
  • 2025-12-04: patched: Initial patch committed to stable tree
  • 2026-01-13: advisory: CVE published

References

Related threats