Skip to main content

Linux Kernel CVE-2025-68302

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Remote/no-auth crash so AV:N/PR:N, but the NULL skb arises from internal allocation/refill failure not directly attacker-controlled, so AC:H; impact is availability-only (kernel oops), hence C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:12 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: sxgbe: fix potential NULL dereference in sxgbe_rx()

Currently, when skb is null, the driver prints an error and then dereferences skb on the next line.

To fix this, let's add a 'break' after the error message to switch to sxgbe_rx_refill(), which is similar to the approach taken by the other drivers in this particular case, e.g. calxeda with xgmac_rx().

Found during a code review.

AnalysisAI

Denial of service in the Linux kernel's Samsung sxgbe 10G Ethernet driver stems from a NULL pointer dereference in sxgbe_rx(), where the receive path logs an error when an skb is NULL but then dereferences that same NULL skb on the following line. The fix adds a 'break' so the code falls through to sxgbe_rx_refill() instead of crashing, mirroring the handling already used by other NIC drivers such as Calxeda's xgmac_rx(). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile); the bug was found during code review rather than in-the-wild.

Technical ContextAI

The affected component is drivers/net/ethernet/samsung/sxgbe, the mainline Linux driver for Samsung's SXGBE 10-Gigabit Ethernet controller. In the RX processing loop, when socket buffer (skb) allocation or lookup yields NULL, the driver emits a diagnostic message but continues to access skb, producing a classic NULL pointer dereference (CWE-476), which in kernel context typically causes an oops/panic. The condition is only reachable on hosts that actually contain and load the sxgbe driver - i.e., systems using this specific Samsung 10G MAC IP. The CWE was reported as N/A in the source feed but the root cause is unambiguously a NULL-pointer dereference on the receive datapath.

Affected ProductsAI

The Linux kernel's mainline sxgbe (Samsung 10G Ethernet) driver is affected on systems where that driver is compiled and loaded. No CPE strings were supplied and the source data does not enumerate exact affected kernel version ranges; the fix was distributed across multiple stable trees, as evidenced by seven git.kernel.org stable commit references (e.g., 18ef3ad1bb57dcf1a9ee61736039aedccf670b21, 45b5b4ddb8d6bea5fc1625ff6f163bbb125d49cc, 46e5332126596a2ca791140feab18ce1fc1a3c86, and 7fd789d6ea4915034eb6bcb72f6883c8151083e5). Consult those commits and your distribution's kernel changelog to map the fix to your running kernel version.

RemediationAI

Upstream fix available (commits) - update to a stable kernel release that includes the sxgbe_rx() NULL-check patch referenced by the seven git.kernel.org stable commits (e.g., https://git.kernel.org/stable/c/18ef3ad1bb57dcf1a9ee61736039aedccf670b21 and https://git.kernel.org/stable/c/45b5b4ddb8d6bea5fc1625ff6f163bbb125d49cc); a released patched tag version is not independently confirmed from the provided data, so match the commit to your stable series via your distro's kernel package. Because the vulnerable code path only exists when the sxgbe driver is loaded, an effective compensating control on systems that do not use Samsung SXGBE 10G hardware is to blacklist/unload the sxgbe module (e.g., via modprobe blacklist), which removes the attack surface entirely with no functional impact on unaffected hardware; on systems that do rely on the NIC, prioritize the kernel update since unloading the module would drop network connectivity.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-68302 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy