Skip to main content

Linux Kernel CVE-2025-68321

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.5 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
2.5 LOW

Impact is log verbosity only during pre-existing OOM, so AC:H and PR:L reflect the required local memory-pressure precondition; A:L, no C/I impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:09 vuln.today
CVE Published
Dec 16, 2025 - 16:16 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

page_pool: always add GFP_NOWARN for ATOMIC allocations

Driver authors often forget to add GFP_NOWARN for page allocation from the datapath. This is annoying to users as OOMs are a fact of life, and we pretty much expect network Rx to hit page allocation failures during OOM. Make page pool add GFP_NOWARN for ATOMIC allocations by default.

AnalysisAI

Denial-of-service hardening in the Linux kernel's page_pool subsystem addresses noisy allocation-failure handling on the network receive datapath. Because driver authors frequently omit GFP_NOWARN, ATOMIC page allocations that fail under memory pressure emit full allocation-failure warnings/backtraces; the fix makes page_pool add GFP_NOWARN by default for ATOMIC allocations. Rated CVSS 7.5 for availability impact only (C:N/I:N), with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).

Technical ContextAI

The affected component is the kernel's page_pool allocator, a shared caching layer that network device drivers use to recycle DMA-mapped pages for high-throughput RX processing. On the hot receive path, drivers request pages with GFP_ATOMIC (non-sleeping) allocations; under OOM these are expected to fail transiently. Without GFP_NOWARN, each failure triggers a verbose kernel warning and stack dump. The change centralizes GFP_NOWARN so all ATOMIC page_pool allocations suppress these warnings by default. CWE is listed as N/A by the source; functionally this is closer to a resource-exhaustion/log-amplification (CWE-400/CWE-779-style) hardening than a memory-safety defect. CPE data was not provided; affected scope is inferred from the stable-tree commits only.

Affected ProductsAI

The Linux kernel's page_pool subsystem is affected across multiple stable branches, as evidenced by six stable-tree fix commits (git.kernel.org commits 0ec2cd5c, 3671a077, 7613c06f, 9835a0fd, ab48dc0e, and f3b52167), which indicates the fix was backported to several maintained stable series. Exact vulnerable version ranges are not enumerated in the provided data (no CPE strings or NVD version ranges supplied); affected kernels are those containing page_pool prior to the backported commits. Any kernel where network drivers use page_pool for RX is potentially in scope. Consult the individual commit pages and the corresponding stable release notes to map fixed versions to each branch.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the referenced stable commits (0ec2cd5c58793d0c622797cd5fbe26634b357210, 3671a0775952026228ae44e096eb144bca75f8dc, 7613c06ffa89c1e2266fb532e23ef7dfdf269d73, 9835a0fd59a1df5ec0740fdab6d50db68e0f10de, ab48dc0e23eb714b3f233f8e8f6deed7df2051f5, f3b52167a0cb23b27414452fbc1278da2ee884fc at git.kernel.org/stable). Given the low severity and the nature of the change (warning suppression), routine kernel patching cadence is sufficient - no emergency action is warranted. As a compensating measure until patched, operators can reduce log-flood impact by rate-limiting kernel messages (e.g., tune printk rate limiting via kernel.printk_ratelimit / dmesg_restrict) and by ensuring adequate memory/swap headroom to avoid the OOM conditions that trigger the warnings; the trade-off of message rate-limiting is potential loss of genuinely useful diagnostic warnings.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2025-68321 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy