CVE-2025-68200 bpf: Add bpf_prog_run_data_pointers()
A local attacker can trigger a kernel warning and potential crash by exploiting a memory collision in BPF traffic control handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68200?
CVE-2025-68200 is a memory corruption vulnerability in Linux, published on 16 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add bpf_prog_run_data_pointers()
syzbot found that cls_bpf_classify() is able to change tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline] WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214
struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched: Extend qdisc control block with tc control block"), which added a wrong interaction with db58ba459202 ("bpf: wire in data and data_end for cls_act_bpf").
drop_reason was added later.
Add bpf_prog_run_data_pointers() helper to save/restore the net_sched storage colliding with BPF data_meta/data_end.
Which versions are affected by CVE-2025-68200?
How do I fix CVE-2025-68200?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-68200 being exploited?
There is no known exploitation of CVE-2025-68200 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68200, DEBIAN-CVE-2025-68200, GHSA-jxw4-crcg-x436, ROOT-OS-DEBIAN-12-CVE-2025-68200, ROOT-OS-DEBIAN-13-CVE-2025-68200, ROOT-OS-UBUNTU-2204-CVE-2025-68200 and 2 more.