CVE-2025-68725: bpf: Do not let BPF test infra emit invalid GSO types to stack
bpf: Do not let BPF test infra emit invalid GSO types to stack
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix that adds an additional check so malformed/non-trustworthy gso_type coming from BPF test infra (triggered via bpf_clone_redirect()) is rejected in the GSO fast path (described as rejecting such packets right there where gso_features_check() / netif_skb_features() would warn).
Linux kernel (GSO/GSO type validation) gso_type handling for BPF test infra = reject invalid/mismatched gso_type packets emitted to the stack via bpf_clone_redirect()
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68725?
The severity of CVE-2025-68725 is classified as medium due to potential issues with packet offloading in the Linux kernel.
How do I fix CVE-2025-68725?
To fix CVE-2025-68725, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-68725?
CVE-2025-68725 affects all versions of the Linux kernel where the BPF test framework is utilized.
Is CVE-2025-68725 remotely exploitable?
CVE-2025-68725 is not directly remotely exploitable; it requires local access and specific conditions to be met.
What does CVE-2025-68725 impact in the Linux kernel?
CVE-2025-68725 impacts the BPF test infrastructure and can result in invalid GSO types being emitted, potentially causing network packet handling issues.