Skip to main content

Linux Kernel CVE-2025-68192

CRITICAL
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Triggered by received packets so AV:N/PR:N, but requires qmimux+IPsec on an alignment-strict platform so AC:H; impact is a crash only, hence C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 HIGH
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:24 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup

Raw IP packets have no MAC header, leaving skb->mac_header uninitialized. This can trigger kernel panics on ARM64 when xfrm or other subsystems access the offset due to strict alignment checks.

Initialize the MAC header to prevent such crashes.

This can trigger kernel panics on ARM when running IPsec over the qmimux0 interface.

Example trace:

Internal error: Oops: 000000009600004f [#1] SMP CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1 Hardware name: LS1028A RDB Board (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : xfrm_input+0xde8/0x1318 lr : xfrm_input+0x61c/0x1318 sp : ffff800080003b20 Call trace: xfrm_input+0xde8/0x1318 xfrm6_rcv+0x38/0x44 xfrm6_esp_rcv+0x48/0xa8 ip6_protocol_deliver_rcu+0x94/0x4b0 ip6_input_finish+0x44/0x70 ip6_input+0x44/0xc0 ipv6_rcv+0x6c/0x114 __netif_receive_skb_one_core+0x5c/0x8c __netif_receive_skb+0x18/0x60 process_backlog+0x78/0x17c __napi_poll+0x38/0x180 net_rx_action+0x168/0x2f0

AnalysisAI

Kernel panic (denial of service) in the Linux kernel's qmi_wwan USB WWAN driver occurs because qmimux_rx_fixup() leaves skb->mac_header uninitialized for raw-IP packets that have no MAC header; on ARM64, strict-alignment access to that offset by xfrm/IPsec crashes the machine. The flaw is reachable when IPsec (ESP) traffic is received over a qmimux0 multiplexed interface, as shown by the provided oops in xfrm_input(). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a config-specific crash rather than broad remote code execution.

Technical ContextAI

The affected component is the qmi_wwan driver (drivers/net/usb/qmi_wwan.c), which handles Qualcomm MSM Interface (QMI) USB cellular modems and supports QMI multiplexing (qmimux) to expose multiple logical netdevs (qmimux0, etc.). QMI multiplexed traffic is delivered as raw IP (no Ethernet/MAC header), so the socket buffer's mac_header field is never set in the rx_fixup path. When downstream subsystems such as xfrm/IPsec (xfrm_input -> xfrm6_esp_rcv) dereference the MAC header offset, an unaligned/invalid access occurs; ARM64's strict alignment enforcement turns this into a fatal Oops. NVD lists CWE as N/A, but the root cause is effectively use of an uninitialized value / improper pointer offset (CWE-457/CWE-824 class). The reference set is eight git.kernel.org stable-tree commits, indicating backports across multiple maintained kernel branches.

Affected ProductsAI

The affected product is the Linux kernel, specifically the qmi_wwan USB WWAN network driver with QMI multiplexing (qmimux) enabled. No specific fixed version numbers or CPE strings were provided in the input; the eight referenced git.kernel.org/stable commits (e.g. https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb and 0aabccdcec1f4a36f95829ea2263f845bbc77223) indicate fixes backported across multiple stable branches. The reproduction was on kernel 6.12.34 on an NXP LS1028A RDB (ARM64) board, so ARM64 platforms using cellular QMI modems with IPsec are the primary at-risk configuration. Exact vulnerable-version ranges should be confirmed against each stable branch's changelog.

RemediationAI

Upstream fix available (commit); released patched version not independently confirmed - apply the kernel update that includes the qmi_wwan change 'net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup', available via the eight referenced stable commits at git.kernel.org (e.g. https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb). Update to the patched point release of your kernel's stable branch and match the commit to your distribution's kernel package. If patching cannot be done immediately, effective compensating controls are configuration-specific: disable QMI multiplexing (qmimux) on the qmi_wwan modem and use the plain wwan0/raw-IP interface instead, which removes the vulnerable rx_fixup path but changes how multiple PDN contexts are exposed; or avoid running IPsec/xfrm directly over the qmimux interface (terminate the tunnel on a different, MAC-bearing interface), which prevents xfrm from touching the uninitialized offset but may require topology changes. These workarounds trade off multi-context cellular functionality and IPsec placement for stability until the kernel is updated.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68192 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy