CVE-2025-68799: caif: fix integer underflow in cffrml_receive()
In the Linux kernel, the following vulnerability has been resolved:
caif: fix integer underflow in cffrmlreceive()
The cffrmlreceive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without validating that len >= 2.
If an attacker sends a malicious packet with a length field of 0 or 1 to an interface with FCS disabled, the subtraction causes an integer underflow.
This can lead to memory exhaustion and kernel instability, potential information disclosure if padding contains uninitialized kernel memory.
Fix this by validating that len >= 2 before performing the subtraction.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux kernel CAIF cffrml_receive() function, validate that the extracted packet length is at least 2 before subtracting 2 when FCS is disabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68799?
CVE-2025-68799 is classified as medium severity due to potential integer underflow issues.
How do I fix CVE-2025-68799?
To fix CVE-2025-68799, update your Linux kernel to the latest stable version which includes the patch for the cffrml_receive() function.
What systems are impacted by CVE-2025-68799?
CVE-2025-68799 affects Linux kernel systems using the caif subsystem.
What does CVE-2025-68799 exploit?
CVE-2025-68799 exploits an integer underflow in the cffrml_receive() function affecting packet length handling.
Is CVE-2025-68799 a critical vulnerability?
CVE-2025-68799 is not categorized as critical, but it still poses risks that should be mitigated.