CVE-2025-68768: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68768 is a Linux kernel vulnerability in the inet fragmentation subsystem, specifically a deadlock condition caused by improper cleanup ordering during network namespace (netns) teardown. The flaw causes conntrack to loop indefinitely in nf_conntrack_cleanup_net_list() because fragment queue SKBs holding conntrack references are not flushed before conntrack cleanup runs — a consequence of nf_defrag_ipv6 loading before conntrack and thus having its netns exit hooks run after conntrack's. The vulnerability affects Linux kernel versions from 5.3 up to (but not including) the patched commits, with fixes backported to stable branches and included in kernel 6.18.3 and 6.19-rc2. No official CVSS score has been assigned by NVD at this time; Feedly estimates the severity as Medium (Feedly, NVD).

The root cause is a race condition / improper resource cleanup ordering (related to CWE-667: Improper Locking) in the Linux kernel's IP fragmentation queue management. When a network namespace exits, nf_defrag_ipv6 (which conntrack depends on) loads first, meaning its netns exit hooks execute after conntrack's exit hook. This leaves SKBs sitting in fragment queues that still hold conntrack references, causing nf_conntrack_cleanup_net_list() to spin indefinitely waiting for those references to be released. The fix flushes all fragment queue SKBs during fqdir_pre_exit() to release conntrack references before conntrack cleanup runs, and also flushes queues in timer expiry handlers when fqdir->dead is detected. The issue was observed consistently following execution of the ip_defrag.sh test in the NIPA (Network Infrastructure Performance Analysis) test suite (NVD, Feedly).

The primary impact is a denial of service (DoS) through a kernel deadlock on pernet_ops_rwsem. When triggered, the conntrack cleanup thread loops indefinitely holding the rwsem as a reader, blocking any writer (e.g., modprobe loading a kernel module such as ipvlan) from acquiring the lock, effectively hanging the affected process and potentially rendering the system unresponsive for network namespace operations. This affects availability of the kernel's networking subsystem; there is no known confidentiality or integrity impact. Systems using network namespaces with IP fragmentation and conntrack (common in container environments) are most at risk (NVD, Feedly).

The fix is included in Linux kernel stable commits 006a5035b495 and c70df25214ac, as well as 543555954b1e, targeting kernel versions 6.18.3 and 6.19-rc2 (NVD). Downstream distributions have issued patches: Ubuntu has released advisories USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1; SUSE has released SUSE-2026:0447-1; and Debian has addressed the issue in Debian 13 (Ubuntu USN-8177-1, Feedly). Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround, avoiding rapid creation/destruction of network namespaces with active IP fragmentation workloads may reduce exposure.