Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can crash ARM or ARM64 systems handling IPsec traffic through a QMIMUX mobile-broadband interface. The documented impact is a kernel panic and service outage. Although the supplied CVSS is 9.8, the sources do not demonstrate confidentiality or integrity loss, and exposure depends on specific hardware, driver, interface, and traffic conditions.
Executive priority
Prioritize prompt remediation for ARM-based gateways, routers, and embedded systems using IPsec over QMIMUX because a panic could interrupt connectivity or security services. Fleet-wide emergency action is less justified where the required driver and traffic path are absent. Confirm actual exposure before applying the critical CVSS rating uniformly.
Technical view
Raw IP packets processed by qmi_wwan's qmimux_rx_fixup may retain an uninitialized skb MAC-header offset. XFRM or another subsystem can access that invalid offset, triggering strict-alignment faults and kernel panics on ARM architectures. Linux resolved the defect by initializing the MAC header. The supplied trace shows the failure in xfrm_input while receiving IPv6 ESP traffic.
Likely exposure
Most likely exposure is ARM or ARM64 Linux equipment using qmi_wwan/QMIMUX, particularly IPsec over qmimux0. Systems without that driver, interface, architecture, or traffic path appear less exposed based on the description. The supplied affected-version data is ambiguous, so organizations should verify vendor package status rather than relying solely on listed version strings.
Exploitation context
The supplied record is not in CISA KEV, and no cited source reports active exploitation or provides evidence of a practical attack. The CVSS vector describes unauthenticated network reachability, but the technical evidence provided documents a crash condition only. Whether arbitrary remote traffic can reliably trigger the panic is not established by these sources.
Researcher notes
The record's 9.8 vector claims high confidentiality, integrity, and availability impact, while the description and trace substantiate only availability loss. No CWE is supplied. The duplicated commit identifier and ambiguous affected-version list reduce confidence in precise range interpretation. Use the upstream stable commits and distribution backport information for branch-specific assessment.
Mitigation direction
- Update to a vendor-supported Linux kernel containing the applicable referenced qmi_wwan fix.
- Confirm the distribution or device vendor maps its patched package to an upstream stable fix.
- If updating is delayed, reduce IPsec use over qmimux0 where operationally feasible.
- Monitor relevant systems for kernel panics or Oops events involving XFRM processing.
Validation and detection
- Inventory ARM and ARM64 systems using qmi_wwan, QMIMUX, or a qmimux0 interface.
- Identify systems carrying IPsec or other XFRM traffic over QMIMUX interfaces.
- Compare running kernel packages against vendor advisories and the referenced stable fixes.
- Review logs for Oops traces involving xfrm_input, xfrm6_rcv, or related receive processing.
- After updating, validate normal IPsec traffic over QMIMUX in a controlled environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68192 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d693c47fb902b988f5752182e4f7fbde5e6dcaf9CVE reference, Linux
- https://git.kernel.org/stable/c/0aabccdcec1f4a36f95829ea2263f845bbc77223CVE reference, Linux
- https://git.kernel.org/stable/c/4e6b9004f01d0fef5b19778399bc5bf55f8c2d71CVE reference, Linux
- https://git.kernel.org/stable/c/bf527b80b80a282ab5bf1540546211fc35e5cd42CVE reference, Linux
- https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fbCVE reference, Linux
- https://git.kernel.org/stable/c/ae811175cea35b03ac6d7c910f43a82a43b9c3b3CVE reference, Linux
- https://git.kernel.org/stable/c/8ab3b8f958d861a7f725a5be60769106509fbd69CVE reference, Linux
- https://git.kernel.org/stable/c/e120f46768d98151ece8756ebd688b0e43dc8b29CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.