Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-68341: Linux kernel veth driver can expose stale network data
CVE-2025-68341 · published 10 months ago
Summary
The virtual Ethernet (veth) component in the Linux kernel could let two processing threads interfere with each other, potentially showing old or uninitialized network information. This race condition occurs when the system handles high‑performance packet processing (AF_XDP) and can lead to incorrect data being sent or received. Updating the kernel to the latest version resolves the issue, so apply the latest Linux updates to your servers.
What to do
- Update canonical linux-nvidia-6.17 to version 6.17.0-1018.18.
- Update canonical linux-oem-6.17 to version 6.17.0-1017.17.
- Update canonical linux-aws-6.17 to version 6.17.0-1009.9~24.04.2.
- Update canonical linux-azure-6.17 to version 6.17.0-1010.10~24.04.1.
- Update canonical linux-gcp-6.17 to version 6.17.0-1009.9~24.04.3.
- Update canonical linux-hwe-6.17 to version 6.17.0-19.19~24.04.2.
- Update canonical linux-oracle-6.17 to version 6.17.0-1009.9~24.04.1.
- Update canonical linux-riscv-6.17 to version 6.17.0-19.19.1~24.04.1.
- Update canonical linux-realtime-6.17 to version 6.17.0-1008.9~24.04.1.
- Update canonical linux to version 6.17.0-19.19.
- Update canonical linux-aws to version 6.17.0-1009.9.
- Update canonical linux-azure to version 6.17.0-1010.10.
- Update canonical linux-gcp to version 6.17.0-1009.9.
- Update canonical linux-oracle to version 6.17.0-1009.9.
- Update canonical linux-raspi to version 6.17.0-1010.10.
- Update canonical linux-realtime to version 6.17.0-1008.9.
- Update canonical linux-riscv to version 6.17.0-19.19.1.
- Update debian linux to version 6.12.63-1.
- Update debian linux to version 6.17.11-1.
- Update linux kernel to version 6.17.11.
- Update linux linux to version c1ceabcb347d1b0f7e70a7384ec7eff3847b7628 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux |
< c1ceabcb347d1b0f7e70a7384ec7eff3847b7628 6.11 |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.17 |
< 6.17.0-1018.18 Fix: upgrade to 6.17.0-1018.18
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.17 |
< 6.17.0-1017.17 Fix: upgrade to 6.17.0-1017.17
|
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
Showing 50 of 122. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-aws-6.17 |
< 6.17.0-1009.9~24.04.2 Fix: upgrade to 6.17.0-1009.9~24.04.2
|
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.17 |
< 6.17.0-1010.10~24.04.1 Fix: upgrade to 6.17.0-1010.10~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.17 |
< 6.17.0-1009.9~24.04.3 Fix: upgrade to 6.17.0-1009.9~24.04.3
|
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.17 |
< 6.17.0-19.19~24.04.2 Fix: upgrade to 6.17.0-19.19~24.04.2
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.17 |
< 6.17.0-1009.9~24.04.1 Fix: upgrade to 6.17.0-1009.9~24.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.17 |
< 6.17.0-19.19.1~24.04.1 Fix: upgrade to 6.17.0-19.19.1~24.04.1
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 | All versions |
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.17 |
< 6.17.0-1008.9~24.04.1 Fix: upgrade to 6.17.0-1008.9~24.04.1
|
| Ubuntu:25.10 | canonical | linux |
< 6.17.0-19.19 Fix: upgrade to 6.17.0-19.19
|
| Ubuntu:25.10 | canonical | linux-aws |
< 6.17.0-1009.9 Fix: upgrade to 6.17.0-1009.9
|
| Ubuntu:25.10 | canonical | linux-azure |
< 6.17.0-1010.10 Fix: upgrade to 6.17.0-1010.10
|
| Ubuntu:25.10 | canonical | linux-azure-fde | All versions |
| Ubuntu:25.10 | canonical | linux-gcp |
< 6.17.0-1009.9 Fix: upgrade to 6.17.0-1009.9
|
| Ubuntu:25.10 | canonical | linux-oracle |
< 6.17.0-1009.9 Fix: upgrade to 6.17.0-1009.9
|
| Ubuntu:25.10 | canonical | linux-raspi |
< 6.17.0-1010.10 Fix: upgrade to 6.17.0-1010.10
|
| Ubuntu:25.10 | canonical | linux-realtime |
< 6.17.0-1008.9 Fix: upgrade to 6.17.0-1008.9
|
| Ubuntu:25.10 | canonical | linux-riscv |
< 6.17.0-19.19.1 Fix: upgrade to 6.17.0-19.19.1
|
| Debian:13 | debian | linux |
< 6.12.63-1 Fix: upgrade to 6.12.63-1
|
| Debian:14 | debian | linux |
< 6.17.11-1 Fix: upgrade to 6.17.11-1
|
| Linux | linux | kernel |
>= 6.13.0, < 6.17.11 Fix: upgrade to 6.17.11
|
Original advisory text
veth: reduce XDP no_direct return section to fix race
In the Linux kernel, the following vulnerability has been resolved:
veth: reduce XDP no_direct return section to fix race
As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing
old or uninitialized descriptors") for veth there is a chance after
napi_complete_done() that another CPU can manage start another NAPI
instance running veth_pool(). For NAPI this is correctly handled as the
napi_schedule_prep() check will prevent multiple instances from getting
scheduled, but for the remaining code in veth_pool() this can run
concurrent with the newly started NAPI instance.
The problem/race is that xdp_clear_return_frame_no_direct() isn't
designed to be nested.
Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via
task_struct on PREEMPT_RT.") the temporary BPF net context
bpf_redirect_info was stored per CPU, where this wasn't an issue. Since
this commit the BPF context is stored in 'current' task_struct. When
running veth in threaded-NAPI mode, then the kthread becomes the storage
area. Now a race exists between two concurrent veth_pool() function calls
one exiting NAPI and one running new NAPI, both using the same BPF net
context.
Race is when another CPU gets within the xdp_set_return_frame_no_direct()
section before exiting veth_pool() calls the clear-function
xdp_clear_return_frame_no_direct().
veth: reduce XDP no_direct return section to fix race
As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing
old or uninitialized descriptors") for veth there is a chance after
napi_complete_done() that another CPU can manage start another NAPI
instance running veth_pool(). For NAPI this is correctly handled as the
napi_schedule_prep() check will prevent multiple instances from getting
scheduled, but for the remaining code in veth_pool() this can run
concurrent with the newly started NAPI instance.
The problem/race is that xdp_clear_return_frame_no_direct() isn't
designed to be nested.
Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via
task_struct on PREEMPT_RT.") the temporary BPF net context
bpf_redirect_info was stored per CPU, where this wasn't an issue. Since
this commit the BPF context is stored in 'current' task_struct. When
running veth in threaded-NAPI mode, then the kthread becomes the storage
area. Now a race exists between two concurrent veth_pool() function calls
one exiting NAPI and one running new NAPI, both using the same BPF net
context.
Race is when another CPU gets within the xdp_set_return_frame_no_direct()
section before exiting veth_pool() calls the clear-function
xdp_clear_return_frame_no_direct().
References
- https://git.kernel.org/stable/c/a14602fcae17a3f1cb8a8521bedf31728f9e7e39 URL
- https://git.kernel.org/stable/c/c1ceabcb347d1b0f7e70a7384ec7eff3847b7628 URL
- https://ubuntu.com/security/notices/USN-8094-4 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8094-5 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8152-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2025-68341 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-68341 Third Party Advisory
- https://git.kernel.org/linus/a14602fcae17a3f1cb8a8521bedf31728f9e7e39 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8094-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8094-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8094-3 Vendor Advisory
- https://git.kernel.org/stable/c/d0bd018ad72a8a598ae709588934135017f8af52 URL
- https://security-tracker.debian.org/tracker/CVE-2025-68341 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68341... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-68341 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Severity
9.8
Critical
Timeline
Published23 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
UBUNTU-CVE-2025-68341 · OSV
CVE-2025-68341 · NVD
CVE-2025-68341 · MITRE
DEBIAN-CVE-2025-68341 · OSV
CVE-2025-68341 · OSV
Track software like this
Free during beta