CVE-2025-68725: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68725 is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) test infrastructure that allows local low-privileged attackers to trigger a Denial of Service condition by emitting invalid Generic Segmentation Offload (GSO) types to the network stack. The flaw was disclosed on December 24, 2025, and affects multiple Linux kernel versions: 5.6–5.10 (before 5.10.249), 5.11–5.15 (before 5.15.199), 5.16–6.1 (before 6.1.162), 6.2–6.6 (before 6.6.122), 6.7–6.12 (before 6.12.68), and 6.13+ (before 6.18.2). It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause lies in the convert___skb_to_skb() function within the BPF test infrastructure, which sets gso_segs and gso_size on socket buffers (SKBs) but fails to set gso_type. This results in malformed GSO properties being passed into the network stack. When a BPF program triggered via the BPF test infrastructure uses bpf_clone_redirect() to push a packet to the loopback device, the malformed SKB reaches netif_skb_features() → gso_features_check(), triggering skb_warn_bad_offload() and causing GSO-related offload features to be disabled. The vulnerability is classified under improper input validation (CWE-20) and requires only local access with low privileges (no user interaction needed) to exploit (Red Hat Bugzilla, Red Hat Advisory).

The primary impact is a Denial of Service (DoS) condition affecting network performance: GSO-related offload features are disabled on affected packets, which can degrade throughput on systems where BPF programs are actively used. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The scope is local to the affected system, with no evidence of lateral movement potential or data exposure risk (Red Hat Advisory, Red Hat Bugzilla).

Apply the patched Linux kernel version corresponding to your current series: 5.10.249 (for 5.6–5.10), 5.15.199 (for 5.11–5.15), 6.1.162 (for 5.16–6.1), 6.6.122 (for 6.2–6.6), 6.12.68 (for 6.7–6.12), or 6.18.2 (for 6.13+). Patch commits are available in the Linux kernel stable repository. As a workaround where patching is not immediately feasible, restrict BPF program execution to trusted users only (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl). Distributions including Debian, Ubuntu, SUSE, Oracle Linux, and Amazon Linux 2 have issued updated kernel packages (Red Hat Bugzilla, Debian LTS Announce, Ubuntu USN-8177-1).