PT-2026-2500 · Linux+2 · Linux Kernel+2
Published
2025-12-06
·
Updated
2026-05-26
·
CVE-2025-68768
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel related to network packet fragmentation and conntrack. Specifically, the issue involves pending SKBs (socket buffers) holding conntrack references during network namespace exit operations, potentially leading to deadlocks. The problem arises because the netns exit hook for nf defrag ipv6 runs after conntrack's hook. Flushing fragment queues during fqdir pre exit helps release these references before conntrack cleanup, mitigating the deadlock risk. The issue was observed in NIPA environments, often triggered by module loading (e.g., ipvlan) and related to the ip defrag.sh test suite.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu