UBUNTU-CVE-2025-68360: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks MT7996 driver can use both wed and wedhif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wedhif2 (e.g. 6GHz link). [ 297.455876] Unable to handle kernel read from unreadable memory at virtual address 000000000000080a [ 297.464928] Mem abort info: [ 297.467722] ESR = 0x0000000096000005 [ 297.471461] EC = 0x25: DABT (current EL), IL = 32 bits [ 297.476766] SET = 0, FnV = 0 [ 297.479809] EA = 0, S1PTW = 0 [ 297.482940] FSC = 0x05: level 1 translation fault [ 297.487809] Data abort info: [ 297.490679] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 297.496156] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 297.501196] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 297.506500] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107480000 [ 297.512927] [000000000000080a] pgd=08000001097fb003, p4d=08000001097fb003, pud=08000001097fb003, pmd=0000000000000000 [ 297.523532] Internal error: Oops: 0000000096000005 [#1] SMP [ 297.715393] CPU: 2 UID: 0 PID: 45 Comm: kworker/u16:2 Tainted: G O 6.12.50 #0 [ 297.723908] Tainted: [O]=OOTMODULE [ 297.727384] Hardware name: Banana Pi BPI-R4 (2x SFP+) (DT) [ 297.732857] Workqueue: nfftoffloaddel nfflowrulerouteipv6 [nfflowtable] [ 297.740254] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 297.747205] pc : mt76wedoffloaddisable+0x64/0xa0 [mt76] [ 297.752688] lr : mtkwedflowremove+0x58/0x80 [ 297.757126] sp : ffffffc080fe3ae0 [ 297.760430] x29: ffffffc080fe3ae0 x28: ffffffc080fe3be0 x27: 00000000deadbef7 [ 297.767557] x26: ffffff80c5ebca00 x25: 0000000000000001 x24: ffffff80c85f4c00 [ 297.774683] x23: ffffff80c1875b78 x22: ffffffc080d42cd0 x21: ffffffc080660018 [ 297.781809] x20: ffffff80c6a076d0 x19: ffffff80c6a043c8 x18: 0000000000000000 [ 297.788935] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000000 [ 297.796060] x14: 0000000000000019 x13: ffffff80c0ad8ec0 x12: 00000000fa83b2da [ 297.803185] x11: ffffff80c02700c0 x10: ffffff80c0ad8ec0 x9 : ffffff81fef96200 [ 297.810311] x8 : ffffff80c02700c0 x7 : ffffff80c02700d0 x6 : 0000000000000002 [ 297.817435] x5 : 0000000000000400 x4 : 0000000000000000 x3 : 0000000000000000 [ 297.824561] x2 : 0000000000000001 x1 : 0000000000000800 x0 : ffffff80c6a063c8 [ 297.831686] Call trace: [ 297.834123] mt76wedoffloaddisable+0x64/0xa0 [mt76] [ 297.839254] mtkwedflowremove+0x58/0x80 [ 297.843342] mtkflowoffloadcmd+0x434/0x574 [ 297.847689] mtkwedsetuptcblockcb+0x30/0x40 [ 297.852295] nfflowoffloadipv6hook+0x7f4/0x964 [nfflowtable] [ 297.858466] nfflowrulerouteipv6+0x438/0x4a4 [nfflowtable] [ 297.864463] processonework+0x174/0x300 [ 297.868465] workerthread+0x278/0x430 [ 297.872204] kthread+0xd8/0xdc [ 297.875251] retfromfork+0x10/0x20 [ 297.878820] Code: 928b5ae0 8b000273 91400a60 f943fa61 (79401421) [ 297.884901] ---[ end trace 0000000000000000 ]--- Fix the issue detecting the proper wed reference to use running wed callabacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.2 - Upgrade
Upgrade
ubuntu/linux-azure-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1010.10~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.3 - Upgrade
Upgrade
ubuntu/linux-hwe-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-19.19~24.04.2 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1035.38 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-19.19.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.9~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-19.19 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-19.19.1
Event History
Frequently Asked Questions
Which systems are most likely to be affected?
Systems using the MT7996 wireless driver with WED traffic offload are relevant. The issue occurs when the hardware uses the wed_hif2 device, such as a 6 GHz link, rather than the primary WED device.
What is the observable impact if the issue is triggered?
The kernel can crash with an unreadable-memory access and an internal error/Oops. The provided crash example shows a level 1 translation fault while running on wed_hif2.
How can I identify a possible occurrence?
Review kernel logs for an "Unable to handle kernel read from unreadable memory" message followed by an "Internal error: Oops" and a virtual address such as 000000000000080a. Confirm whether the affected wireless hardware was operating through wed_hif2, including on a 6 GHz link.