CVE-2025-68341

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

veth: reduce XDP no_direct return section to fix race

As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing

old or uninitialized descriptors") for veth there is a chance after

napi_complete_done() that another CPU can manage start another NAPI

instance running veth_pool(). For NAPI this is correctly handled as the

napi_schedule_prep() check will prevent multiple instances from getting

scheduled, but for the remaining code in veth_pool() this can run

concurrent with the newly started NAPI instance.

The problem/race is that xdp_clear_return_frame_no_direct() isn't

designed to be nested.

Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via

task_struct on PREEMPT_RT.") the temporary BPF net context

bpf_redirect_info was stored per CPU, where this wasn't an issue. Since

this commit the BPF context is stored in 'current' task_struct. When

running veth in threaded-NAPI mode, then the kthre

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References