CVE-2025-68200: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68200 is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) subsystem involving improper interaction between cls_bpf_classify() and the tc_skb_cb control block structure. Specifically, cls_bpf_classify() can corrupt tc_skb_cb(skb)->drop_reason by overwriting it with BPF data_meta/data_end pointers, triggering a kernel warning in sk_skb_reason_drop(). The vulnerability was introduced by a wrong interaction between commit ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block") and commit db58ba459202 ("bpf: wire in data and data_end for cls_act_bpf"). It was disclosed on December 16, 2025, and affects the Linux kernel from the introduction of ec624fe740b4 through multiple stable branches. No CVSS score has been assigned at this time (Feedly, ENISA EUVD).

The root cause is a memory layout collision (related to CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) between the tc_skb_cb structure's drop_reason field and the BPF data_meta/data_end pointers stored in the same skb control block region. When cls_bpf_classify() runs a BPF program and sets data_meta/data_end in the skb CB, it inadvertently overwrites the drop_reason field that was added later to tc_skb_cb. This causes a kernel WARNING at net/core/skbuff.c:1192 in sk_skb_reason_drop() when the corrupted drop_reason value is subsequently used. The fix introduces a bpf_prog_run_data_pointers() helper that saves and restores the net_sched storage fields that collide with BPF data_meta/data_end before and after BPF program execution (Feedly, ENISA EUVD).

Exploitation of this vulnerability can cause kernel warnings and potentially destabilize the networking stack on affected Linux systems, primarily impacting availability. The corruption of drop_reason in the skb control block may lead to incorrect packet drop accounting, unexpected kernel behavior, or system instability when traffic classification via cls_bpf is active. The impact is primarily local to the kernel's networking subsystem and does not appear to directly enable privilege escalation or remote code execution based on available information (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68200. The vulnerability was discovered by syzbot (Google's kernel fuzzing infrastructure), indicating it was found through automated fuzzing rather than active exploitation. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Patches have been backported to multiple stable Linux kernel branches. Fixed versions include: 5.15.197, 6.1.159, 6.6.117, 6.12.59, 6.17.9, and 6.18. Administrators should update to the patched kernel version applicable to their distribution. Downstream distributions including Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096), Debian (DLA-4436-1), Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8116-1), and SUSE have released updated kernel packages (Feedly, Ubuntu Advisory, Debian LTS, Amazon Linux).