CVE-2025-68241 - Vulnerability Details

- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe

The sit driver's packet transmission path calls: sit_tunnel_xmit() ->
update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called
to delete entries exceeding FNHE_RECLAIM_DEPTH+random.

The race window is between fnhe_remove_oldest() selecting fnheX for
deletion and the subsequent kfree_rcu(). During this time, the
concurrent path's __mkroute_output() -> find_exception() can fetch the
soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a
new dst using a dst_hold(). When the original fnheX is freed via RCU,
the dst reference remains permanently leaked.

CPU 0 CPU 1
__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]

This issue manifests as a device reference count leak and a warning in
dmesg when unregistering the net device:

unregister_netdevice: waiting for sitX to become free. Usage count = N

Ido Schimmel provided the simple test validation method [1].

The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes().
Since rt_bind_exception() checks this field, setting it to zero prevents
the stale fnhe from being reused and bound to a new dst just before it
is freed.

[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1

Published: 2025-12-16

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e46e23c289f62ccd8e2230d9ce652072d777ff30`	affected	< 69d35c12168f9c59b159ae566f77dfad9f96d7ca
`5867e20e1808acd0c832ddea2587e5ee49813874`	affected	< 4b7210da22429765d19460d38c30eeca72656282
`67d6d681e15b578c1725bad8ad079e05d1c48a8e`	affected	< 298f1e0694ab4edb6092d66efed93c4554e6ced1
`67d6d681e15b578c1725bad8ad079e05d1c48a8e`	affected	< b8a44407bdaf2f0c5505cc7d9fc7d8da90cf9a94
`67d6d681e15b578c1725bad8ad079e05d1c48a8e`	affected	< 041ab9ca6e80d8f792bb69df28ebf1ef39c06af8
`67d6d681e15b578c1725bad8ad079e05d1c48a8e`	affected	< b84f083f50ecc736a95091691339a1b363962f0e
`67d6d681e15b578c1725bad8ad079e05d1c48a8e`	affected	< 0fd16ed6dc331636fb2a874c42d2f7d3156f7ff0
`67d6d681e15b578c1725bad8ad079e05d1c48a8e`	affected	< ac1499fcd40fe06479e9b933347b837ccabc2a40
`bed8941fbdb72a61f6348c4deb0db69c4de87aca`	affected	—
`f10ce783bcc4d8ea454563a7d56ae781640e7dcb`	affected	—
`f484595be6b7ef9d095a32becabb5dae8204fb2a`	affected	—
`3e6bd2b583f18da9856fc9741ffa200a74a52cba`	affected	—
`5ae06218331f39ec45b5d039aa7cb3ddd4bb8008`	affected	—
`4589a12dcf80af31137ef202be1ff4a321707a73`	affected	—
`5.4.146`	affected	< 5.4.302
`5.10.65`	affected	< 5.10.247
`4.4.284`	affected	< 4.5
`4.9.283`	affected	< 4.10
`4.14.247`	affected	< 4.15
`4.19.207`	affected	< 4.20
`5.13.17`	affected	< 5.14
`5.14.4`	affected	< 5.15

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`5.4.302`	unaffected	≤ 5.4.*
`5.10.247`	unaffected	≤ 5.10.*
`5.15.197`	unaffected	≤ 5.15.*
`6.1.159`	unaffected	≤ 6.1.*
`6.6.117`	unaffected	≤ 6.6.*
`6.12.59`	unaffected	≤ 6.12.*
`6.17.9`	unaffected	≤ 6.17.*
`6.18`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4436-1	linux-6.1 security update
Ubuntu USN	USN-8029-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8030-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8029-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8048-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8029-3	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8095-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8096-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8095-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8096-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8100-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8095-3	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8096-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8096-4	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8095-4	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8096-5	Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Ubuntu USN	USN-8116-1	Linux kernel (Intel IoTG Real-time) vulnerabilities
Ubuntu USN	USN-8125-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8126-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8095-5	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8141-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8163-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8165-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8163-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8243-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8261-1	Linux kernel (Xilinx) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/041ab9ca6e80d8f792bb69df28ebf1ef39c06af8
https://git.kernel.org/stable/c/0fd16ed6dc331636fb2a874c42d2f7d3156f7ff0
https://git.kernel.org/stable/c/298f1e0694ab4edb6092d66efed93c4554e6ced1
https://git.kernel.org/stable/c/4b7210da22429765d19460d38c30eeca72656282
https://git.kernel.org/stable/c/69d35c12168f9c59b159ae566f77dfad9f96d7ca
https://git.kernel.org/stable/c/ac1499fcd40fe06479e9b933347b837ccabc2a40
https://git.kernel.org/stable/c/b84f083f50ecc736a95091691339a1b363962f0e
https://git.kernel.org/stable/c/b8a44407bdaf2f0c5505cc7d9fc7d8da90cf9a94
https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68241-854d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-68241
https://www.cve.org/CVERecord?id=CVE-2025-68241

History

Wed, 17 Dec 2025 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025121632-CVE-2025-68241-854d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-68241 https://www.cve.org/CVERecord?id=CVE-2025-68241
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Tue, 16 Dec 2025 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe The sit driver's packet transmission path calls: sit_tunnel_xmit() -> update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called to delete entries exceeding FNHE_RECLAIM_DEPTH+random. The race window is between fnhe_remove_oldest() selecting fnheX for deletion and the subsequent kfree_rcu(). During this time, the concurrent path's __mkroute_output() -> find_exception() can fetch the soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a new dst using a dst_hold(). When the original fnheX is freed via RCU, the dst reference remains permanently leaked. CPU 0 CPU 1 __mkroute_output() find_exception() [fnheX] update_or_create_fnhe() fnhe_remove_oldest() [fnheX] rt_bind_exception() [bind dst] RCU callback [fnheX freed, dst leak] This issue manifests as a device reference count leak and a warning in dmesg when unregistering the net device: unregister_netdevice: waiting for sitX to become free. Usage count = N Ido Schimmel provided the simple test validation method [1]. The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes(). Since rt_bind_exception() checks this field, setting it to zero prevents the stale fnhe from being reused and bound to a new dst just before it is freed. [1] ip netns add ns1 ip -n ns1 link set dev lo up ip -n ns1 address add 192.0.2.1/32 dev lo ip -n ns1 link add name dummy1 up type dummy ip -n ns1 route add 192.0.2.2/32 dev dummy1 ip -n ns1 link add name gretap1 up arp off type gretap \ local 192.0.2.1 remote 192.0.2.2 ip -n ns1 route add 198.51.0.0/16 dev gretap1 taskset -c 0 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & taskset -c 2 ip netns exec ns1 mausezahn gretap1 \ -A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q & sleep 10 ip netns pids ns1 \| xargs kill ip netns del ns1
Title		ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/041ab9ca6e80d8f792bb69df28ebf1ef39c06af8 https://git.kernel.org/stable/c/0fd16ed6dc331636fb2a874c42d2f7d3156f7ff0 https://git.kernel.org/stable/c/298f1e0694ab4edb6092d66efed93c4554e6ced1 https://git.kernel.org/stable/c/4b7210da22429765d19460d38c30eeca72656282 https://git.kernel.org/stable/c/69d35c12168f9c59b159ae566f77dfad9f96d7ca https://git.kernel.org/stable/c/ac1499fcd40fe06479e9b933347b837ccabc2a40 https://git.kernel.org/stable/c/b84f083f50ecc736a95091691339a1b363962f0e https://git.kernel.org/stable/c/b8a44407bdaf2f0c5505cc7d9fc7d8da90cf9a94

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-12-16T14:21:18.682Z

Updated: 2026-05-23T16:02:28.625Z

Reserved: 2025-12-16T13:41:40.263Z

Link: CVE-2025-68241

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2025-12-16T15:15:53.283

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-68241

Redhat

Severity : Moderate

Publid Date: 2025-12-16T00:00:00Z

Links: CVE-2025-68241 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object