CVE-2025-68241

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe

The sit driver's packet transmission path calls: sit_tunnel_xmit() ->

update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called

to delete entries exceeding FNHE_RECLAIM_DEPTH+random.

The race window is between fnhe_remove_oldest() selecting fnheX for

deletion and the subsequent kfree_rcu(). During this time, the

concurrent path's __mkroute_output() -> find_exception() can fetch the

soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a

new dst using a dst_hold(). When the original fnheX is freed via RCU,

the dst reference remains permanently leaked.

CPU 0 CPU 1

__mkroute_output()

find_exception() [fnheX]

update_or_create_fnhe()

fnhe_remove_oldest() [fnheX]

rt_bind_exception() [bind dst]

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References