CVE-2025-68787: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-68787 is a memory leak vulnerability in the Linux kernel's netrom subsystem, specifically within the nr_sendmsg() function in net/netrom/af_netrom.c. When sock_alloc_send_skb() returns NULL inside nr_output(), the original socket buffer (skb) allocated in nr_sendmsg() is not freed before the function returns, causing unreferenced memory to accumulate over time. The vulnerability was published on January 13, 2026, and affects the Linux kernel across multiple distributions including Debian, Ubuntu, and Microsoft's Azure Linux (azl3_kernel prior to 6.6.119.3-3). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is a missing kfree_skb() call on the error path in nr_sendmsg() (CWE-401: Missing Release of Memory after Effective Lifetime). When sock_alloc_send_skb() fails and returns NULL during nr_output() processing, the function returns an error without freeing the skb that was previously allocated via alloc_skb_with_frags() → sock_alloc_send_pskb(). The bug was originally identified by syzbot, which reported an unreferenced object of size 240 bytes at address 0xffff888129f35500, with the allocation traceable through kmem_cache_alloc_node_noprof → __alloc_skb → alloc_skb_with_frags → sock_alloc_send_pskb → nr_sendmsg. The fix involves adding an kfree_skb() call before returning on the error path (Feedly).

Successful exploitation allows a local attacker with low privileges to cause a denial of service by progressively exhausting kernel memory through repeated socket send operations on netrom sockets. Over time, the unreleased memory accumulates, leading to system performance degradation, application crashes, or complete system unavailability. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly, Microsoft MSRC).

1. Gain local access: Obtain a low-privilege local user account on a vulnerable Linux system with the netrom kernel module loaded or loadable.
2. Create a netrom socket: Use the socket(AF_NETROM, SOCK_SEQPACKET, 0) system call to open a netrom socket, which requires the AF_NETROM address family to be available.
3. Trigger the allocation failure path: Repeatedly call sendmsg() on the netrom socket under memory pressure conditions (e.g., with a large payload or when system memory is constrained) so that sock_alloc_send_skb() returns NULL inside nr_output().
4. Accumulate leaked memory: Each failed send operation leaks a 240-byte skb allocation. Repeat the operation in a loop to progressively exhaust kernel memory.
5. Achieve denial of service: As kernel memory is exhausted, system performance degrades and eventually the system becomes unresponsive or crashes (Feedly).

• Logs: Kernel messages from kmemleak reporting unreferenced objects with backtrace pointing to nr_sendmsg+0x287/0x450 net/netrom/af_netrom.c:1105 and alloc_skb_with_frags in the allocation chain.
• System Behavior: Gradual increase in kernel memory consumption (/proc/meminfo showing decreasing MemFree/MemAvailable) without a corresponding increase in user-space process memory usage.
• Process: Unusual or repeated socket operations from a low-privilege process using AF_NETROM sockets, visible via ss -a or /proc/net/nr.
• Kernel Debug: Output from echo scan > /sys/kernel/debug/kmemleak showing repeated unreferenced objects of size 240 bytes allocated via kmem_cache_alloc_node_noprof (Feedly).

Apply the upstream Linux kernel patch that adds kfree_skb() on the error return path in nr_sendmsg(). Patched versions are available through multiple distribution channels: Microsoft Azure Linux (azl3_kernel 6.6.119.3-3 and later), Debian (linux 6.1.162-1 for oldstable, linux 5.10.249-1 for oldoldstable), and Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1, and subsequent updates). As a workaround where patching is not immediately possible, restrict or blacklist the netrom kernel module (modprobe -r netrom or add blacklist netrom to /etc/modprobe.d/) to prevent unprivileged users from creating netrom sockets (Feedly, Microsoft MSRC).