CVE-2025-68325: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68325 is a NULL pointer dereference vulnerability in the Linux kernel's network scheduler subsystem (net/sched: sch_cake), caused by incorrect queue length (qlen) reduction in the cake_drop() function. The flaw was disclosed on December 18, 2025, and affects multiple stable Linux kernel versions prior to the backported fixes (including branches up to 6.12.x, 6.17.x, and 6.18.x). No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium with an EPSS score of 0.000180 (Red Hat CVE, Feedly).

The root cause is an incorrect assumption in cake_enqueue() that the parent qdisc will always enqueue the current packet after cake_drop() calls qdisc_tree_reduce_backlog() to update the qlen/backlog hierarchy. When cake_enqueue() returns NET_XMIT_CN, the parent qdisc skips enqueuing the packet, leaving the tree's qlen/backlog accounting inconsistent. This accounting mismatch can trigger a NULL pointer dereference — specifically observed when the parent qdisc is qfq_qdisc — classified under improper resource management (no CWE formally assigned by NVD). The fix computes the qlen/backlog delta by observing differences before and after cake_drop() calls and compensates the tree accounting when NET_XMIT_CN is returned; a new variable is also introduced to preserve correct qlen when ACK thinning is enabled (kernel.org patches).

Successful exploitation of this vulnerability can cause a kernel NULL pointer dereference, leading to a system crash (kernel panic) and denial of service on affected Linux systems. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Systems using the CAKE (Common Applications Kept Enhanced) traffic shaper in combination with a parent qdisc such as QFQ are most directly at risk (Red Hat CVE).

1. Identify a vulnerable target: Locate a Linux system running a kernel version affected by CVE-2025-68325 (prior to the stable backport fixes in 6.12.63, 6.17.13, 6.18.2, or 6.19-rc1) with local access or the ability to influence network traffic scheduling configuration.
2. Configure CAKE as a child qdisc: Set up or leverage an existing network configuration where the CAKE qdisc (sch_cake) is used as a child under a parent qdisc such as QFQ (qfq_qdisc), which is the known trigger condition.
3. Trigger packet congestion: Generate network traffic that causes cake_enqueue() to invoke cake_drop() under conditions where the queue is full, causing qdisc_tree_reduce_backlog() to decrement the parent's qlen.
4. Induce NET_XMIT_CN return: Craft traffic patterns that cause cake_enqueue() to return NET_XMIT_CN, so the parent qdisc skips enqueuing the current packet, leaving the qlen/backlog accounting inconsistent.
5. Trigger NULL dereference: The accounting mismatch causes the parent qdisc (e.g., qfq_qdisc) to dereference a NULL pointer during subsequent operations, resulting in a kernel panic and system crash (kernel.org patches, Feedly).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing sch_cake, cake_drop, cake_enqueue, or qfq_qdisc with a NULL pointer dereference trace.
• Process/System: Unexpected system reboots or kernel panics on hosts using CAKE-based traffic shaping; dmesg entries showing BUG: kernel NULL pointer dereference in the networking subsystem.
• Network: Unusual traffic patterns or queue management anomalies on interfaces configured with CAKE as a child qdisc under QFQ or similar parent qdiscs.

Apply the upstream kernel patches that fix the incorrect qlen reduction logic in cake_drop(). Patched versions include Linux kernel stable releases 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1, with backport commits available at the kernel.org stable tree (kernel.org patches). Major distributions have issued updates: Ubuntu (USN-8094, USN-8096, USN-8152, USN-8179, USN-8184, USN-8185, USN-8203, USN-8258, USN-8260, USN-8265), Debian (DSA-6127-1, DLA-4476-1), SUSE, Oracle Linux, and Amazon Linux 2 (Ubuntu Security, Debian LTS, Amazon Linux). As a workaround where patching is not immediately possible, avoid using CAKE as a child qdisc under QFQ or other parent qdiscs that may trigger the vulnerable code path.

The vulnerability received standard coverage from Linux distribution security teams, with Red Hat, Ubuntu, Debian, SUSE, Oracle Linux, and Amazon Linux all issuing advisories and kernel updates. A brief social media post was noted on Bluesky from a CVE tracking account. No notable independent researcher commentary or significant media coverage beyond routine distribution security advisories has been identified (Red Hat CVE, Ubuntu Security).