CVE-2025-68192: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68192 is a Linux kernel vulnerability in the net/usb/qmi_wwan driver where the MAC header offset in the qmimux_rx_fixup function is left uninitialized for raw IP packets. This uninitialized skb->mac_header value can trigger kernel panics (Oops) on ARM and ARM64 systems when subsystems such as xfrm (IPsec) access the offset due to strict alignment checks. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from 4.12 up to the patched stable releases. The EPSS score is approximately 0.024% (Low), and no official CVSS base score has been assigned by the Linux kernel CNA (Feedly, EUVD).

The root cause is an uninitialized variable (CWE-457) — specifically, skb->mac_header is never set in qmimux_rx_fixup() because raw IP packets carry no MAC header. When the kernel's xfrm (IPsec) or other network subsystems subsequently attempt to read the MAC header offset, they access an indeterminate memory location, causing misaligned memory access faults on ARM/ARM64 architectures with strict alignment enforcement. The fix initializes the MAC header via skb_reset_mac_header() before the packet is passed up the network stack. The vulnerability is triggered specifically when IPsec (e.g., ESP over IPv6) is used over a qmimux0 interface backed by a QMI/WWAN USB modem (Feedly).

Successful triggering of this vulnerability causes a kernel panic (denial of service) on affected ARM/ARM64 systems running IPsec over QMI WWAN multiplexed interfaces. The crash occurs in interrupt context (PID 0, swapper), meaning the entire system becomes unavailable and requires a reboot. There is no evidence of confidentiality or integrity impact — the primary consequence is availability loss on embedded or IoT devices using QMI USB modems with IPsec, such as NXP LS1028A-based networking appliances (Feedly).

• Logs: Kernel log entries containing Internal error: Oops: 000000009600004f or similar ARM64 fault codes; call traces involving xfrm_input, xfrm6_rcv, xfrm6_esp_rcv, ip6_protocol_deliver_rcu in /var/log/kern.log or dmesg.
• Process: System crash or unexpected reboot on ARM/ARM64 devices using USB QMI WWAN modems (e.g., qmimux0 interface) with IPsec configured.
• Network: Kernel panic triggered upon receipt of ESP/IPv6 packets on a qmimux0 interface.

The Linux kernel stable trees have released fixes across all supported branches. Patched versions include: 5.4.302, 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, and 6.18. Downstream distributions including Ubuntu (USN-8096-1/2/3/5), Debian LTS (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-112), and Oracle Linux have also released updated kernel packages. Administrators should update to a patched kernel version; as a temporary workaround, avoiding IPsec over QMI WWAN multiplexed interfaces (qmimux) on ARM/ARM64 systems will prevent the crash (Ubuntu Advisory, Debian LTS, Amazon Linux).