Linux Kernel CVE-2025-68341

In the Linux kernel, the following vulnerability has been resolved:

veth: reduce XDP no_direct return section to fix race

As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI this is correctly handled as the napi_schedule_prep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance.

The problem/race is that xdp_clear_return_frame_no_direct() isn't designed to be nested.

Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the temporary BPF net context bpf_redirect_info was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' task_struct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent veth_pool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context.

Race is when another CPU gets within the xdp_set_return_frame_no_direct() section before exiting veth_pool() calls the clear-function xdp_clear_return_frame_no_direct().

The vulnerability affects the Linux kernel, specifically the veth driver, on kernels that include commit 401cb7dae813 (which relocated bpf_redirect_info into task_struct) and that expose veth XDP in threaded-NAPI mode. No CPE strings or explicit version ranges were provided in the intelligence set, and CWE is listed as N/A, so exact vulnerable version boundaries are not confirmed here; the affected range is bounded on the upper end by the fix commits. The corrective changes are published in the stable tree at https://git.kernel.org/stable/c/d0bd018ad72a8a598ae709588934135017f8af52 , https://git.kernel.org/stable/c/c1ceabcb347d1b0f7e70a7384ec7eff3847b7628 , and https://git.kernel.org/stable/c/a14602fcae17a3f1cb8a8521bedf31728f9e7e39 , indicating multiple stable branches received backports.