CVE-2025-68234: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68234 is a logic error vulnerability in the Linux kernel's io_uring/cmd_net subsystem involving incorrect argument ordering in a call to skb_queue_splice(). When timestamp retrieval needs to be retried and the local SKB (socket buffer) list already contains entries, the buffers are spliced back into the socket queue — but due to transposed arguments, the splice occurs in the wrong direction, corrupting the on-stack list. The vulnerability was published on December 16, 2025, and affects Linux kernel versions prior to the fixes introduced in stable commits c85d2cfc5e24 and 46447367a529. No official CVSS score has been assigned; Feedly estimates the severity as Medium, and the EPSS score is approximately 0.018% (Feedly, ENISA EUVD).

The root cause is an argument transposition bug (CWE-628: Function Call with Incorrectly Specified Arguments) in the io_uring command networking path (io_uring/cmd_net.c). Specifically, when skb_queue_splice() is called to move SKBs from a local on-stack list back into the socket's receive queue during a timestamp retry, the source and destination arguments are swapped, causing the splice to proceed in the reverse direction. This results in incorrect queue state — entries may be lost, duplicated, or placed in the wrong queue — leading to potential memory corruption or use-after-free conditions depending on subsequent operations. The fix involves correcting the argument order in the skb_queue_splice() call, as reflected in upstream stable commits (Kernel Git, Kernel Git).

Exploitation of this vulnerability could result in kernel memory corruption due to improper SKB queue management within the io_uring networking command path. Depending on the specific kernel version and workload, this could lead to system instability, kernel panics (denial of service), or potentially exploitable memory safety violations. The impact is limited to systems actively using io_uring with network socket commands and timestamp retrieval, reducing the practical attack surface to specific workloads (Feedly).

Apply the upstream Linux kernel patches that correct the argument order in skb_queue_splice() within io_uring/cmd_net.c. The fixes are available in stable commits c85d2cfc5e24e6866b56c7253fd4e1c7db35986c (targeting one stable branch) and 46447367a52965e9d35f112f5b26fc8ff8ec443d (targeting another), with patched versions including Linux 6.17.10 and 6.18 (Kernel Git, Kernel Git). Ubuntu has issued security notices USN-8094-1 through USN-8094-5 and USN-8152-1 addressing this CVE among other kernel vulnerabilities (Ubuntu USN-8094-1, Ubuntu USN-8152-1). As a workaround where patching is not immediately possible, restricting unprivileged access to io_uring (e.g., via sysctl kernel.io_uring_disabled=1 or seccomp policies) can reduce exposure.