Skip to main content

Linux Kernel CVE-2025-68724

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local user must feed a crafted certificate into the keyring (AV:L, PR:L, AC:L); resulting kernel heap overflow gives high C/I/A within the same component (S:U).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.1 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 30, 2026 - 06:42 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
CVE Published
Dec 24, 2025 - 11:16 cve.org
HIGH 7.8
CVE Published
Dec 24, 2025 - 11:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

Use check_add_overflow() to guard against potential integer overflows when adding the binary blob lengths and the size of an asymmetric_key_id structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a possible buffer overflow when copying data from potentially malicious X.509 certificate fields that can be arbitrarily large, such as ASN.1 INTEGER serial numbers, issuer names, etc.

AnalysisAI

Memory corruption in the Linux kernel's asymmetric_keys crypto subsystem allows a local low-privileged user to trigger a heap buffer overflow by supplying a crafted X.509 certificate. The flaw lives in asymmetric_key_generate_id(), where the sizes of attacker-controlled binary blobs (such as arbitrarily large ASN.1 INTEGER serial numbers and issuer names) are added to the size of an asymmetric_key_id structure without overflow checking, so an integer overflow yields an undersized allocation and a subsequent out-of-bounds copy. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).

Technical ContextAI

The affected code is the kernel keyrings asymmetric-key facility (crypto/asymmetric_keys), which parses X.509 certificates to build key identifiers used for PKCS#7 signature verification, module signing, and keyring lookups. asymmetric_key_generate_id() computes a buffer size by summing two attacker-influenced blob lengths plus sizeof(struct asymmetric_key_id); because these values derive from raw certificate DER fields that can be arbitrarily large, the arithmetic can wrap. The root cause is a classic integer-overflow-leading-to-buffer-overflow (CWE-190 into CWE-122/CWE-787); the vendor did not assign a CWE (listed N/A). The fix replaces the unchecked addition with check_add_overflow() and returns ERR_PTR(-EOVERFLOW) on wrap.

Affected ProductsAI

The Linux kernel (crypto/asymmetric_keys subsystem) is affected across multiple stable branches, as indicated by the eight git.kernel.org stable-tree commit references (e.g., 5b8ac617c8da, 60a7be5ee744, c73be4f51eed) that carry the fix and its backports; exact fixed release tags are not stated in the provided data. Siemens has published advisory SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html) covering Siemens products that embed the affected Linux kernel. No NVD CPE strings were supplied to pin precise version ranges, so affected versions should be confirmed against each distribution's changelog for the referenced commits.

RemediationAI

Upstream fix available as stable-tree commits (see git.kernel.org references such as 5b8ac617c8dab5cad3c4dc8d84d0987808a0f99c and c73be4f51eed); a single canonical released patched version is not independently confirmed from the provided data, so update to your distribution's kernel build that incorporates these commits. For Siemens products, follow the remediation and fixed-firmware guidance in advisory SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html). Until patched, reduce exposure by restricting the ability of untrusted local users to load certificates or keys into the kernel keyring (limit add_key/keyctl and certificate-import paths) and by avoiding parsing of untrusted X.509 material; note these controls may break legitimate key-management workflows and do not fully close attack paths where certificate parsing is triggered by system services.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-68724 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy