CyberSecBulletin
CVE-2025-68795NVD status: Deferred

Linux: Heap-based Buffer Overflow

Published Updated By the CyberSecBulletin desk

CVE-2025-68795 is a high-severity heap-based buffer overflow vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 3df375a1e75483b7d973c3cc2e46aa374db8428b, f9dc0f45d2cd0189ce666288a29d2cc32c2e44d5, 4afcb985355210e1688560dc47e64b94dad35d71 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 3df375a1e75483b7d973c3cc2e46aa374db8428b or f9dc0f45d2cd0189ce666288a29d2cc32c2e44d5 or 4afcb985355210e1688560dc47e64b94dad35d71 or ca9983bc3a1189bd72f9ae449d925a66b2616326, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3df375a1e75483b7d973c3cc2e46aa374db8428b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, f9dc0f45d2cd0189ce666288a29d2cc32c2e44d5; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 4afcb985355210e1688560dc47e64b94dad35d71; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, ca9983bc3a1189bd72f9ae449d925a66b2616326; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 7bea09f60f2ad5d232e2db8f1c14e850fd3fd416; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 4066b5b546293f44cd6d0e84ece6e3ee7ff27093; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 7b07be1ff1cb6c49869910518650e8d0abc7d25f; 2.6.123df375a1e75483b7d973c3cc2e46aa374db8428b, f9dc0f45d2cd0189ce666288a29d2cc32c2e44d5, 4afcb985355210e1688560dc47e64b94dad35d71, ca9983bc3a1189bd72f9ae449d925a66b2616326, 7bea09f60f2ad5d232e2db8f1c14e850fd3fd416, 4066b5b546293f44cd6d0e84ece6e3ee7ff27093

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTOOL_GSTATS for the values. If the number of stats changes between these calls (e.g., due to device reconfiguration), userspace's buffer allocation will be incorrect, potentially leading to buffer overflow. Drivers are generally expected to maintain stable stat counts, but some drivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making this scenario possible. Some drivers try to handle this internally: - bnad_get_ethtool_stats() returns early in case stats.n_stats is not equal to the driver's stats count. - micrel/ksz884x also makes sure not to write anything beyond stats.n_stats and overflow the buffer. However, both use stats.n_stats which is already assigned with the value returned from get_sset_count(), hence won't solve the issue described here. Change ethtool_get_strings(), ethtool_get_stats(), ethtool_get_phy_stats() to not return anything in case of a mismatch between userspace's size and get_sset_size(), to prevent buffer overflow. The returned n_stats value will be equal to zero, to reflect that nothing has been returned. This could result in one of two cases when using upstream ethtool, depending on when the size change is detected: 1. When detected in ethtool_get_strings(): # ethtool -S eth2 no stats available 2. When detected in get stats, all stats will be reported as zero. Both cases are presumably transient, and a subsequent ethtool call should succeed. Other than the overflow avoidance, these two cases are very evident (no output/cleared stats), which is arguably better than presenting incorrect/shifted stats. I also considered returning an error instead of a "silent" response, but that seems more destructive towards userspace apps. Notes: - This patch does not claim to fix the inherent race, it only makes sure that we do not overflow the userspace buffer, and makes for a more predictable behavior. - RTNL lock is held during each ioctl, the race window exists between the separate ioctl calls when the lock is released. - Userspace ethtool always fills stats.n_stats, but it is likely that these stats ioctls are implemented in other userspace applications which might not fill it. The added code checks that it's not zero, to prevent any regressions.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Heap-based Buffer Overflow

The product writes past the end of a buffer that was allocated on the heap.

How developers prevent this class of flaw

  • Pre-design: Use a language or compiler that performs automatic bounds checking.
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.

More Heap-based Buffer Overflow vulnerabilities (CWE-122)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Heap-based Buffer Overflow vulnerabilities

Spotted an error? Tell us.