Skip to main content

Linux Kernel CVE-2025-68799

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Adjacent CAIF link only (AV:A); no auth or config privilege to send a frame (PR:N); availability high via memory exhaustion (A:H); confidentiality only limited padding leak, so C:L not C:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Jul 30, 2026 - 07:20 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:19 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.1 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

caif: fix integer underflow in cffrml_receive()

The cffrml_receive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without validating that len >= 2.

If an attacker sends a malicious packet with a length field of 0 or 1 to an interface with FCS disabled, the subtraction causes an integer underflow.

This can lead to memory exhaustion and kernel instability, potential information disclosure if padding contains uninitialized kernel memory.

Fix this by validating that len >= 2 before performing the subtraction.

AnalysisAI

Denial of service and potential kernel memory disclosure in the Linux kernel's CAIF protocol stack arises because cffrml_receive() subtracts 2 from a packet-derived length field without checking that the value is at least 2 when FCS checking is disabled. An adjacent attacker sending a CAIF frame whose length field is 0 or 1 triggers an integer underflow, leading to memory exhaustion, kernel instability, and possible leakage of uninitialized kernel memory contained in packet padding. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV.

Technical ContextAI

CAIF (Communication CPU-to-Application-CPU Interface) is a niche Linux networking protocol originally developed for ST-Ericsson modems to carry AT commands, IP and other traffic over a serial/HSI link between an application processor and a baseband modem. The cffrml_receive() function in the CAIF framing layer (net/caif/cffrml.c) parses a length field from the frame header; when the Frame Check Sequence (FCS) feature is disabled it subtracts the 2-byte FCS size from that length before further processing. The root cause is an unchecked arithmetic subtraction on an untrusted length (an integer underflow / CWE-191-class bug, though NVD lists CWE as N/A), which wraps a small value into a very large unsigned length and drives subsequent buffer handling out of bounds.

Affected ProductsAI

The affected product is the Linux kernel, specifically the CAIF networking subsystem (net/caif/cffrml.c). NVD/kernel.org list multiple stable-branch fix commits (git.kernel.org commits 21fdcc00, 4ec29714, 785c7be6, 8a11ff09, c54091ee, f407f1c9, f818cd47), indicating the fix was backported across several maintained stable series; exact vulnerable version ranges are not enumerated in the provided data. Ubuntu tracks this issue in advisory USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1) and VulDB catalogs it at https://vuldb.com/?id.340642. No explicit CPE strings were supplied in the input.

RemediationAI

Patch available per vendor advisory: apply the upstream Linux stable kernel updates that add the len >= 2 validation before the subtraction in cffrml_receive() (kernel.org commits 21fdcc00656a, 4ec29714aa4e, 785c7be63616, 8a11ff0948b5, c54091eec6fe, f407f1c9f45b, f818cd472565). Distribution users should install the fixed packages from their vendor - Ubuntu users via USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1) and then reboot into the patched kernel. Because exact fixed release version numbers were not provided in the input, confirm the target version against your distribution's advisory rather than assuming a tag. As a compensating control where patching must be deferred, disable or unload the CAIF module if it is not needed (e.g. blacklist the caif kernel modules), which fully removes exposure at the cost of losing CAIF modem connectivity on the rare devices that use it; alternatively, enabling FCS on the CAIF link avoids the vulnerable non-FCS subtraction path, and restricting/trusting the adjacent CAIF peer limits who can deliver malformed frames.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2025-68799 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy