CVE-2025-68799: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68799 is an integer underflow vulnerability in the Linux kernel's CAIF (Common Air Interface over Farsi) subsystem, specifically in the cffrml_receive() function. The flaw was published on January 13, 2026, and affects Linux kernel versions from 2.6.35 up to (but not including) the patched stable releases. It carries a CVSS v3.1 base score of 5.3 (Medium), requiring local access and low privileges to exploit (Feedly, Microsoft MSRC).

The root cause is an integer underflow (CWE-191) in cffrml_receive(), which extracts a length field from an incoming CAIF packet header and, when Frame Check Sequence (FCS) is disabled, unconditionally subtracts 2 from this length value without first validating that len >= 2. An attacker with local access who can send network packets to a CAIF-enabled interface with FCS disabled can craft a malicious packet with a length field of 0 or 1, triggering the underflow. The fix, applied across multiple stable kernel branches, adds a bounds check to ensure len >= 2 before the subtraction is performed (Feedly, kernel.org patch).

Successful exploitation can cause memory exhaustion and kernel instability, potentially leading to a denial-of-service condition on the affected system. Additionally, if packet padding areas contain uninitialized kernel memory, exploitation may result in information disclosure, exposing sensitive kernel data to a low-privileged local attacker. The attack is particularly relevant in multi-user systems or containerized environments where unprivileged users can interact with CAIF-enabled network interfaces (Feedly).

Patches are available across multiple Linux kernel stable branches. Fixed versions include Linux kernel 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19-rc2, and later stable releases (Feedly). Downstream distributions including Debian (DSA-6126-1, DLA-4475-1) and Ubuntu (USN-8177-1, USN-8179-1, USN-8183-1, USN-8184-1, USN-8185-1, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1, and subsequent updates) have issued updated kernel packages. For systems that cannot be immediately patched, administrators should restrict access to CAIF interfaces to trusted users only, or disable CAIF networking entirely if it is not required (Feedly).