CVE-2025-68776 (GCVE-0-2025-68776)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:28 – Updated: 2026-07-14 12:44
VLAI
Title
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/hsr: fix NULL pointer dereference in prp_get_untagged_frame() prp_get_untagged_frame() calls __pskb_copy() to create frame->skb_std but doesn't check if the allocation failed. If __pskb_copy() returns NULL, skb_clone() is called with a NULL pointer, causing a crash: Oops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041 Code: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c RSP: 0018:ffffc9000d00f200 EFLAGS: 00010207 RAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000 RBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee R10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000 R13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00 FS: 0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0 Call Trace: <TASK> hsr_forward_do net/hsr/hsr_forward.c:-1 [inline] hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741 hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84 __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966 __netif_receive_skb_one_core net/core/dev.c:6077 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6192 netif_receive_skb_internal net/core/dev.c:6278 [inline] netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337 tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485 tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0449f8e1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 RSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff RDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8 RBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001 R13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003 </TASK> Add a NULL check immediately after __pskb_copy() to handle allocation failures gracefully.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < 3ce95a57d8a1f0e20b637cdeddaaed81831ca819 (git)
Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < c851e43b88b40bb7c20176c51cbf4f8c8d960dd9 (git)
Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < 7be6d25f4d974e44918ba3a5d58ebb9d36879087 (git)
Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < 8f289fa12926aae44347ca7d490e216555d8f255 (git)
Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < 1742974c24a9c1f1fd2e5edca0cbaccb720b397a (git)
Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < 6220d38a08f8837575cd8f830928b49a3a5a5095 (git)
Affected: f266a683a4804dc499efc6c2206ef68efed029d0 , < 188e0fa5a679570ea35474575e724d8211423d17 (git)
Create a notification for this product.
Linux Linux Affected: 3.17
Unaffected: 0 , < 3.17 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:44:13.112Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_forward.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ce95a57d8a1f0e20b637cdeddaaed81831ca819",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            },
            {
              "lessThan": "c851e43b88b40bb7c20176c51cbf4f8c8d960dd9",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            },
            {
              "lessThan": "7be6d25f4d974e44918ba3a5d58ebb9d36879087",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            },
            {
              "lessThan": "8f289fa12926aae44347ca7d490e216555d8f255",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            },
            {
              "lessThan": "1742974c24a9c1f1fd2e5edca0cbaccb720b397a",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            },
            {
              "lessThan": "6220d38a08f8837575cd8f830928b49a3a5a5095",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            },
            {
              "lessThan": "188e0fa5a679570ea35474575e724d8211423d17",
              "status": "affected",
              "version": "f266a683a4804dc499efc6c2206ef68efed029d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_forward.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/hsr: fix NULL pointer dereference in prp_get_untagged_frame()\n\nprp_get_untagged_frame() calls __pskb_copy() to create frame-\u003eskb_std\nbut doesn\u0027t check if the allocation failed. If __pskb_copy() returns\nNULL, skb_clone() is called with a NULL pointer, causing a crash:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]\nCPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041\nCode: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 \u003c43\u003e 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c\nRSP: 0018:ffffc9000d00f200 EFLAGS: 00010207\nRAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480\nRDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000\nRBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee\nR10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000\nR13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00\nFS:  0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0\nCall Trace:\n \u003cTASK\u003e\n hsr_forward_do net/hsr/hsr_forward.c:-1 [inline]\n hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741\n hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84\n __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966\n __netif_receive_skb_one_core net/core/dev.c:6077 [inline]\n __netif_receive_skb+0x72/0x380 net/core/dev.c:6192\n netif_receive_skb_internal net/core/dev.c:6278 [inline]\n netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337\n tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485\n tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953\n tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x5c9/0xb30 fs/read_write.c:686\n ksys_write+0x145/0x250 fs/read_write.c:738\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f0449f8e1ff\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48\nRSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff\nRDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8\nRBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000\nR10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001\nR13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003\n \u003c/TASK\u003e\n\nAdd a NULL check immediately after __pskb_copy() to handle allocation\nfailures gracefully."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:53:08.027Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ce95a57d8a1f0e20b637cdeddaaed81831ca819"
        },
        {
          "url": "https://git.kernel.org/stable/c/c851e43b88b40bb7c20176c51cbf4f8c8d960dd9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7be6d25f4d974e44918ba3a5d58ebb9d36879087"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f289fa12926aae44347ca7d490e216555d8f255"
        },
        {
          "url": "https://git.kernel.org/stable/c/1742974c24a9c1f1fd2e5edca0cbaccb720b397a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6220d38a08f8837575cd8f830928b49a3a5a5095"
        },
        {
          "url": "https://git.kernel.org/stable/c/188e0fa5a679570ea35474575e724d8211423d17"
        }
      ],
      "title": "net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68776",
    "datePublished": "2026-01-13T15:28:52.766Z",
    "dateReserved": "2025-12-24T10:30:51.035Z",
    "dateUpdated": "2026-07-14T12:44:13.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68776",
      "date": "2026-08-11",
      "epss": "0.00177",
      "percentile": "0.07417"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68776\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:15:57.193\",\"lastModified\":\"2026-07-14T13:17:59.863\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/hsr: fix NULL pointer dereference in prp_get_untagged_frame()\\n\\nprp_get_untagged_frame() calls __pskb_copy() to create frame-\u003eskb_std\\nbut doesn\u0027t check if the allocation failed. If __pskb_copy() returns\\nNULL, skb_clone() is called with a NULL pointer, causing a crash:\\n\\nOops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI\\nKASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]\\nCPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nRIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041\\nCode: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 \u003c43\u003e 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c\\nRSP: 0018:ffffc9000d00f200 EFLAGS: 00010207\\nRAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480\\nRDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000\\nRBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee\\nR10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000\\nR13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00\\nFS:  0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0\\nCall Trace:\\n \u003cTASK\u003e\\n hsr_forward_do net/hsr/hsr_forward.c:-1 [inline]\\n hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741\\n hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84\\n __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966\\n __netif_receive_skb_one_core net/core/dev.c:6077 [inline]\\n __netif_receive_skb+0x72/0x380 net/core/dev.c:6192\\n netif_receive_skb_internal net/core/dev.c:6278 [inline]\\n netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337\\n tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485\\n tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953\\n tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999\\n new_sync_write fs/read_write.c:593 [inline]\\n vfs_write+0x5c9/0xb30 fs/read_write.c:686\\n ksys_write+0x145/0x250 fs/read_write.c:738\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7f0449f8e1ff\\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48\\nRSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\\nRAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff\\nRDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8\\nRBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000\\nR10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001\\nR13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003\\n \u003c/TASK\u003e\\n\\nAdd a NULL check immediately after __pskb_copy() to handle allocation\\nfailures gracefully.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet/hsr: correcci\u00f3n de desreferencia de puntero NULL en prp_get_untagged_frame()\\n\\nprp_get_untagged_frame() llama a __pskb_copy() para crear frame-\u0026gt;skb_std, pero no comprueba si la asignaci\u00f3n fall\u00f3. Si __pskb_copy() devuelve NULL, se llama a skb_clone() con un puntero NULL, lo que provoca un fallo:\\n\\nOops: general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] SMP KASAN NOPTI\\nKASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f]\\nCPU: 0 UID: 0 PID: 5625 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)\\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\\nRIP: 0010:skb_clone+0xd7/0x3a0 net/core/skbuff.c:2041\\nCode: 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 29 05 f9 49 83 3e 00 0f 85 a0 01 00 00 e8 94 dd 9d f8 48 8d 6b 7e 49 89 ee 49 c1 ee 03 \u0026lt;43\u0026gt; 0f b6 04 26 84 c0 0f 85 d1 01 00 00 44 0f b6 7d 00 41 83 e7 0c\\nRSP: 0018:ffffc9000d00f200 EFLAGS: 00010207\\nRAX: ffffffff892235a1 RBX: 0000000000000000 RCX: ffff88803372a480\\nRDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000000\\nRBP: 000000000000007e R08: ffffffff8f7d0f77 R09: 1ffffffff1efa1ee\\nR10: dffffc0000000000 R11: fffffbfff1efa1ef R12: dffffc0000000000\\nR13: 0000000000000820 R14: 000000000000000f R15: ffff88805144cc00\\nFS:  0000555557f6d500(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000555581d35808 CR3: 000000005040e000 CR4: 0000000000352ef0\\nCall Trace:\\n \\n hsr_forward_do net/hsr/hsr_forward.c:-1 [inline]\\n hsr_forward_skb+0x1013/0x2860 net/hsr/hsr_forward.c:741\\n hsr_handle_frame+0x6ce/0xa70 net/hsr/hsr_slave.c:84\\n __netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966\\n __netif_receive_skb_one_core net/core/dev.c:6077 [inline]\\n __netif_receive_skb+0x72/0x380 net/core/dev.c:6192\\n netif_receive_skb_internal net/core/dev.c:6278 [inline]\\n netif_receive_skb+0x1cb/0x790 net/core/dev.c:6337\\n tun_rx_batched+0x1b9/0x730 drivers/net/tun.c:1485\\n tun_get_user+0x2b65/0x3e90 drivers/net/tun.c:1953\\n tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1999\\n new_sync_write fs/read_write.c:593 [inline]\\n vfs_write+0x5c9/0xb30 fs/read_write.c:686\\n ksys_write+0x145/0x250 fs/read_write.c:738\\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\\n do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7f0449f8e1ff\\nCode: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48\\nRSP: 002b:00007ffd7ad94c90 EFLAGS: 00000293 ORIG_RAX: 0000000000000001\\nRAX: ffffffffffffffda RBX: 00007f044a1e5fa0 RCX: 00007f0449f8e1ff\\nRDX: 000000000000003e RSI: 0000200000000500 RDI: 00000000000000c8\\nRBP: 00007ffd7ad94d20 R08: 0000000000000000 R09: 0000000000000000\\nR10: 000000000000003e R11: 0000000000000293 R12: 0000000000000001\\nR13: 00007f044a1e5fa0 R14: 00007f044a1e5fa0 R15: 0000000000000003\\n \\n\\nA\u00f1adir una comprobaci\u00f3n de NULL inmediatamente despu\u00e9s de __pskb_copy() para manejar los fallos de asignaci\u00f3n de forma elegante.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/hsr/hsr_forward.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"3ce95a57d8a1f0e20b637cdeddaaed81831ca819\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"c851e43b88b40bb7c20176c51cbf4f8c8d960dd9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"7be6d25f4d974e44918ba3a5d58ebb9d36879087\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"8f289fa12926aae44347ca7d490e216555d8f255\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"1742974c24a9c1f1fd2e5edca0cbaccb720b397a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"6220d38a08f8837575cd8f830928b49a3a5a5095\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f266a683a4804dc499efc6c2206ef68efed029d0\",\"lessThan\":\"188e0fa5a679570ea35474575e724d8211423d17\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/hsr/hsr_forward.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1742974c24a9c1f1fd2e5edca0cbaccb720b397a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/188e0fa5a679570ea35474575e724d8211423d17\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3ce95a57d8a1f0e20b637cdeddaaed81831ca819\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6220d38a08f8837575cd8f830928b49a3a5a5095\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7be6d25f4d974e44918ba3a5d58ebb9d36879087\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f289fa12926aae44347ca7d490e216555d8f255\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c851e43b88b40bb7c20176c51cbf4f8c8d960dd9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:11:10+00:00",
      "cve": "CVE-2025-68776",
      "id": "CVE-2025-68776",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service via NULL pointer dereference in HSR",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68776.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:24:26Z",
      "cve": "CVE-2025-68776",
      "id": "CVE-2025-68776",
      "initial_release_date": "2026-01-15T00:26:38Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "606",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "307",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68776",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68776.json",
      "version": "37"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.