CVE-2025-68206: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68206 is a vulnerability in the Linux kernel's netfilter subsystem, specifically in the nft_ct module, where the sequence adjustment (seqadj) extension is not properly added for NAT-ed connections when an FTP connection tracking helper is assigned after DNAT setup. This flaw can cause incorrect TCP sequence/acknowledgment number handling for FTP traffic using PASV/EPSV modes over NAT, potentially leading to connection disruption or kernel instability. The vulnerability was published on December 16, 2025, and affects the Linux kernel across multiple stable branches. The CVSS score has not been publicly finalized at this time (CVE.org).

The root cause is a missing initialization of the TCP sequence adjustment extension (seqadj) in nft_ct when a connection tracking FTP helper is assigned to a connection after DNAT has already been configured (CWE classification not formally assigned, but relates to improper resource initialization). In FTP PASV/EPSV mode, the kernel must rewrite packet payloads (IP addresses and ports) on the FTP control connection, which changes TCP segment lengths and requires sequence number adjustment. When the FTP helper is set after DNAT (rather than before), the existing check in nf_nat_setup_info() that normally handles seqadj initialization is bypassed, leaving the extension uninitialized. The fix involves ensuring the seqadj extension is allocated for natted connections in nft_ct regardless of helper assignment order (CVE.org).

Exploitation of this vulnerability can cause FTP sessions traversing a NAT gateway using PASV or EPSV mode to fail or produce corrupted TCP streams due to incorrect sequence number adjustments. In affected configurations, this results in availability impact (broken FTP data connections) and potential kernel instability on systems acting as NAT routers or firewalls with nftables-based FTP helper rules. The vulnerability does not appear to allow remote code execution or direct data exfiltration, but could disrupt network services on affected Linux systems (CVE.org).

The Linux kernel maintainers have released patches across multiple stable branches, with fixes committed to kernel stable trees (commits 2b52d89c, 4ab2cd90, 4de80f0d, 83273af0, 90918e3b). Downstream distributions including Ubuntu (USN-8179-1, USN-8179-2, USN-8179-3, USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), Debian (DSA-6243-1, DLA-4561-1), Amazon Linux 2023 (ALAS2023-2026-1681), and Oracle Linux have issued updated kernel packages. Users should update to the latest patched kernel version provided by their distribution. As a workaround, administrators can assign the FTP connection tracking helper before configuring DNAT rules to avoid triggering the problematic code path (Ubuntu USN-8179-1, Amazon Linux).