CyberSecBulletin
CVE-2025-68775NVD status: Deferred

Linux: Improper Synchronization

Published Updated By the CyberSecBulletin desk

CVE-2025-68775 is a critical-severity improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 011ae80c49d9bfa5b4336f8bd387cd25c7593663, e1641177e7fb48a0a5a06658d4aab51da6656659, 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.55% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 011ae80c49d9bfa5b4336f8bd387cd25c7593663 or e1641177e7fb48a0a5a06658d4aab51da6656659 or 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be or 15564bd67e2975002f2a8e9defee33e321d3183f, whichever matches your release line, or a later version.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, 011ae80c49d9bfa5b4336f8bd387cd25c7593663; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, e1641177e7fb48a0a5a06658d4aab51da6656659; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, 15564bd67e2975002f2a8e9defee33e321d3183f; 6.4011ae80c49d9bfa5b4336f8bd387cd25c7593663, e1641177e7fb48a0a5a06658d4aab51da6656659, 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be, 15564bd67e2975002f2a8e9defee33e321d3183f

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed. If a second cancellation request arrives for the same handshake request, then remove_pending() will return false... and assuming HANDSHAKE_F_REQ_COMPLETED isn't set in req->hr_flags, we'll continue processing through the out_true label, where we put another reference on the sock and a refcount underflow occurs. This can happen for example if a handshake times out - particularly if the SUNRPC client sends the AUTH_TLS probe to the server but doesn't follow it up with the ClientHello due to a problem with tlshd. When the timeout is hit on the server, the server will send a FIN, which triggers a cancellation request via xs_reset_transport(). When the timeout is hit on the client, another cancellation request happens via xs_tls_handshake_sync(). Add a test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) in the pending cancel path so duplicate cancels can be detected.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Synchronization

The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

How developers prevent this class of flaw

  • Use industry standard APIs to synchronize your code.

More Improper Synchronization vulnerabilities (CWE-662)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Synchronization vulnerabilities

Spotted an error? Tell us.