CVE-2025-68200: bpf: Add bpf_prog_run_data_pointers()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add bpfprogrundatapointers()
syzbot found that clsbpfclassify() is able to change tcskbcb(skb)->dropreason triggering a warning in skskbreasondrop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 skskbreasondrop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 skskbreasondrop+0x76/0x170 net/core/skbuff.c:1214
struct tcskbcb has been added in commit ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block"), which added a wrong interaction with db58ba459202 ("bpf: wire in data and dataend for clsactbpf").
dropreason was added later.
Add bpfprogrundatapointers() helper to save/restore the netsched storage colliding with BPF datameta/dataend.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68200?
CVE-2025-68200 has been rated as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-68200?
You can mitigate CVE-2025-68200 by updating to the latest stable version of the Linux kernel where the vulnerability has been resolved.
What impact does CVE-2025-68200 have on affected systems?
CVE-2025-68200 allows for potential modification of the drop reason in network packets, which could lead to unexpected behavior in traffic classification.
Which versions of Linux kernel are affected by CVE-2025-68200?
All versions of the Linux kernel prior to the latest patch that addresses CVE-2025-68200 are potentially affected.
Who discovered CVE-2025-68200?
CVE-2025-68200 was discovered by a security researcher using the syzbot automated testing tool.