CVE-2025-68785: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68785 is a slab-out-of-bounds read vulnerability in the Linux kernel's Open vSwitch (OVS) subsystem, specifically in the push_nsh() action handler. The flaw arises from missing validation of the intermediate OVS_KEY_ATTR_NSH netlink attribute within the nested OVS_ACTION_ATTR_PUSH_NSH structure, allowing a local attacker to trigger invalid kernel memory access. It was published on January 13, 2026, and affects the Linux kernel including Microsoft Azure Linux 3 (azl3_kernel_6.6.119.3-3) and multiple upstream kernel versions. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is improper input validation (CWE-125: Out-of-bounds Read) in the push_nsh() action processing path within the Linux kernel's Open vSwitch module. The nested netlink attribute structure OVS_ACTION_ATTR_PUSH_NSH(OVS_KEY_ATTR_NSH(...)) is processed such that the outermost and innermost attributes are validated by separate nla_for_each_nested() calls, but the middle OVS_KEY_ATTR_NSH attribute is never checked for correct type or size. The code performs a double nla_data() unwrap without bounds checking, which may pass silently during validation (where the netlink buffer is larger) but triggers a KASAN-detected slab-out-of-bounds read in nsh_hdr_from_nlattr during action execution, where the buffer is allocated to the exact attribute size. A local attacker with access to netlink sockets can craft a malicious netlink message with an incorrectly sized middle attribute to trigger this condition (Red Hat CVE).

Successful exploitation allows a local attacker with low privileges to read out-of-bounds kernel memory, leading to unauthorized disclosure of sensitive kernel data (high confidentiality impact) and potential kernel crashes causing denial of service (high availability impact). Integrity is not directly affected. The vulnerability is confined to the local system scope but could be leveraged as part of a privilege escalation chain in multi-tenant or containerized environments where OVS is in use (Red Hat CVE).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing KASAN reports such as BUG: KASAN: slab-out-of-bounds in nsh_hdr_from_nlattr with associated stack traces referencing the openvswitch module.
• Process: Unexpected crashes or panics in processes interacting with Open vSwitch netlink interfaces; processes invoking OVS_ACTION_ATTR_PUSH_NSH with malformed attribute sizes.
• Network: Unusual or malformed netlink messages targeting the Open vSwitch kernel module from unprivileged local processes.

Patches have been committed to the Linux kernel stable tree (commits 1b569db9c2f2, 2ecfc4433acd, 3bc2efff20a3, 5ace7ef87f05) adding proper size and type validation for the middle OVS_KEY_ATTR_NSH attribute. Affected distributions including Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, and subsequent updates), Debian (DSA-6126-1, DLA-4475-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), SUSE, and Oracle Linux have released updated kernel packages. As a workaround where patching is not immediately possible, restrict unprivileged user access to netlink sockets and Open vSwitch management interfaces (Red Hat CVE, Ubuntu USN-8177-1).