CVE-2025-68341
- Source
- https://cve.org/CVERecord?id=CVE-2025-68341
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68341.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-68341
- Downstream
- Published
- 2025-12-23T13:58:26.749Z
- Modified
- 2026-03-10T21:52:39.503486Z
- Summary
- veth: reduce XDP no_direct return section to fix race
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
veth: reduce XDP no_direct return section to fix race
As explain in commit fa349e396e48 ("veth: Fix race with AFXDP exposing old or uninitialized descriptors") for veth there is a chance after napicompletedone() that another CPU can manage start another NAPI instance running vethpool(). For NAPI this is correctly handled as the napischeduleprep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance.
The problem/race is that xdpclearreturnframeno_direct() isn't designed to be nested.
Prior to commit 401cb7dae813 ("net: Reference bpfredirectinfo via taskstruct on PREEMPTRT.") the temporary BPF net context bpfredirectinfo was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' taskstruct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent vethpool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context.
Race is when another CPU gets within the xdpsetreturnframenodirect() section before exiting vethpool() calls the clear-function xdpclearreturnframeno_direct().
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68341.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/a14602fcae17a3f1cb8a8521bedf31728f9e7e39
- https://git.kernel.org/stable/c/c1ceabcb347d1b0f7e70a7384ec7eff3847b7628
- https://git.kernel.org/stable/c/d0bd018ad72a8a598ae709588934135017f8af52
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68341.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-68341
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced401cb7dae8130fd34eb84648e02ab4c506df7d5eFixedc1ceabcb347d1b0f7e70a7384ec7eff3847b7628Fixedd0bd018ad72a8a598ae709588934135017f8af52Fixeda14602fcae17a3f1cb8a8521bedf31728f9e7e39