CVE-2025-68795: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68795 is a buffer overflow vulnerability in the Linux kernel's ethtool subsystem, arising from a race condition between sequential ioctl calls used to query network statistics. When device reconfiguration causes the statistics count to change between the ETHTOOL_GSSET_INFO, ETHTOOL_GSTRINGS, and ETHTOOL_GSTATS ioctl calls, the userspace buffer allocation becomes incorrect, potentially leading to a userspace buffer overflow. The vulnerability was published on January 13, 2026, and affects the Linux kernel broadly, with confirmed impact on Microsoft Azure Linux 3 (azl3_kernel version 6.6.119.3-3) and multiple other distributions. It carries a CVSS v3.1 base score of 7.1 (High) (Microsoft MSRC, Feedly).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (related to CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in the ethtool subsystem. The ethtool -S command requires three sequential ioctl calls: the first retrieves the stats count, the second retrieves stat names, and the third retrieves stat values. If a driver with dynamic statistics (such as mlx5, bnx2x, bna, or ksz884x) changes its stat count between these calls — for example, due to device reconfiguration — the userspace buffer allocated based on the initial count will be too small to hold the data returned by the final call, causing an overflow. The fix modifies ethtool_get_strings(), ethtool_get_stats(), and ethtool_get_phy_stats() to detect size mismatches and return nothing (with n_stats set to zero) rather than overflowing the buffer (Feedly, Linux Kernel Patch).

A local attacker with low privileges could exploit this vulnerability to cause a userspace buffer overflow, potentially resulting in memory corruption, application crashes, or arbitrary code execution in userspace context. The integrity and availability impacts are rated High, while confidentiality impact is None, reflecting the risk of data corruption and denial of service rather than information disclosure. Systems running drivers with dynamic statistics counters (mlx5, bnx2x, bna, ksz884x) are particularly susceptible, as these drivers are more likely to trigger the race condition during normal operation (Feedly, Microsoft MSRC).

The vulnerability has been patched in the Linux kernel via commits to the stable trees (e.g., commit 3df375a1e754, 4afcb9853552, 7b07be1ff1cb, 7bea09f60f2a). Affected distributions have released updates: Debian (linux 6.1.162-1 for oldstable, linux 5.10.249-1 for oldoldstable), Ubuntu (USN-8177-1, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1), Amazon Linux 2 (ALAS2KERNEL-5.10-2026-113, ALAS2KERNEL-5.15-2026-098), SUSE, Oracle Linux, and Microsoft Azure Linux 3. Administrators should apply the relevant kernel update for their distribution as the primary remediation; as a secondary measure, restrict ethtool access to authorized users only (Feedly, Debian LTS, Ubuntu USN-8177-1).