Junglewise Threat Intelligence

CVE-2025-68787: Linux Kernel memory leak in NET/ROM nr_sendmsg

CVE-2025-68787 · Severity: info · CVSS 0 · Published 2026-01-13

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A memory leak vulnerability was identified in the Linux kernel's NET/ROM protocol implementation, which is also used in certain Siemens industrial controllers. This flaw occurs when the system fails to properly release memory during network message processing under specific error conditions. If exploited, this could lead to a gradual depletion of system memory, potentially causing system instability or a denial-of-service condition.

Technical details

A memory leak exists in the netrom implementation within the Linux kernel, specifically in the nr_sendmsg() function. The vulnerability is triggered when nr_output() calls sock_alloc_send_skb() and receives a NULL return value; in this error path, the original socket buffer (skb) allocated in nr_sendmsg() is not freed. An attacker with local access could potentially trigger this condition repeatedly to exhaust kernel memory. The fix involves explicitly calling kfree_skb(skb) before returning from the error condition in net/netrom/nr_out.c.

Affected products

  • Linux Linux Kernel 1da177e4c3f4 to f77e538ac4e3adb1882d5bccb7bfdc111b5963d3
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 and earlier
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier

Timeline

  • 2025-11-29: disclosed: Initial patch submitted by Wang Liang
  • 2026-01-13: advisory: CVE published to NVD
  • 2026-07-14: advisory: Siemens updated advisory with affected industrial products

References

Related threats