CVE-2025-68341 veth: reduce XDP no_direct return section to fix race
A race condition in the Linux kernel veth driver involving XDP return frames can lead to undefined behavior or potential memory corruption issues.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68341?
CVE-2025-68341 is a critical vulnerability in Linux, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
veth: reduce XDP no_direct return section to fix race
As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI this is correctly handled as the napi_schedule_prep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance.
The problem/race is that xdp_clear_return_frame_no_direct() isn't designed to be nested.
Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the temporary BPF net context bpf_redirect_info was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' task_struct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent veth_pool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context.
Race is when another CPU gets within the xdp_set_return_frame_no_direct() section before exiting veth_pool() calls the clear-function xdp_clear_return_frame_no_direct().
Which versions are affected by CVE-2025-68341?
How do I fix CVE-2025-68341?
Apply the vendor's patch.
Is CVE-2025-68341 being exploited?
There is no known exploitation of CVE-2025-68341 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-68341, DEBIAN-CVE-2025-68341, GHSA-68w5-72rc-pgrc, UBUNTU-CVE-2025-68341.