CVE-2025-68241: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68241 is a race condition vulnerability in the Linux kernel's IPv4 routing subsystem, specifically in the rt_bind_exception() function, which can cause a device reference count leak when handling stale Forwarding Next-Hop Exceptions (FNHEs). The vulnerability affects the Linux kernel and was published on December 16, 2025. It is estimated as Medium severity with an EPSS score of 0.024% (Feedly, CVE.org).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-362) in the Linux kernel's IPv4 route exception handling. The sit (Simple Internet Transition) tunnel driver's packet transmission path calls update_or_create_fnhe(), which may invoke fnhe_remove_oldest() to evict entries exceeding FNHE_RECLAIM_DEPTH. During the window between fnhe_remove_oldest() selecting an FNHE entry for deletion and the subsequent kfree_rcu() call, a concurrent __mkroute_output() → find_exception() path can fetch the soon-to-be-freed FNHE, and rt_bind_exception() then binds it with a new destination via dst_hold(). When the original FNHE is freed via RCU callback, the held dst reference is permanently leaked. The fix clears oldest->fnhe_daddr before calling fnhe_flush_routes(), causing rt_bind_exception() to skip rebinding stale entries (Feedly).

The primary impact is a kernel memory resource leak — specifically a device reference count leak — that prevents the affected network device (e.g., a SIT tunnel interface sitX) from being properly unregistered. This manifests as a kernel warning: unregister_netdevice: waiting for sitX to become free. Usage count = N. While this does not directly allow code execution or data exfiltration, it can lead to denial of service conditions by exhausting kernel resources or preventing network interface teardown, impacting system availability (Feedly).

There is no known public exploit code or evidence of in-the-wild exploitation for CVE-2025-68241. The vulnerability requires local access to trigger the race condition via SIT tunnel packet transmission, making remote exploitation unlikely. The EPSS score is 0.024%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, CVE.org).

• Logs: Kernel dmesg messages containing unregister_netdevice: waiting for sitX to become free. Usage count = N, indicating a device reference count leak.
• System Behavior: SIT tunnel interfaces (sit0, sit1, etc.) that cannot be removed or remain in a persistent state after attempted teardown.
• Kernel Metrics: Elevated or non-decrementing reference counts on network devices observable via /sys/class/net/<interface>/ or kernel debugging tools such as ip link showing interfaces stuck in a deletion-pending state.

The Linux kernel maintainers have released patches addressing this vulnerability across multiple stable branches, with commits available at the kernel.org stable tree (e.g., commits 0fd16ed, 4b7210d, 041ab9c, 69d35c1, 298f1e0). Downstream distributions including Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8096-5), Debian (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), Oracle Linux, and SUSE have issued updated kernel packages. Users should update to the latest patched kernel version provided by their distribution. As a temporary workaround, avoiding the use of SIT tunnels may reduce exposure (Ubuntu Advisory, Debian LTS, Amazon Linux).