LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68363: bpf: Check skb->transport_header is set in bpf_skb_check_mtu

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue involves a BPF networking helper reading transport-header state that may not be set. The public description mainly shows a kernel warning in BPF test-run conditions, not a confirmed real-world compromise. Business urgency depends on whether exposed systems run affected Linux kernels or vendor products that incorporate them.

Executive priority

Treat as monitor-and-patch, not emergency response, unless a vendor advisory raises impact for your environment. Prioritize internet-facing, shared, or security-sensitive Linux platforms during routine kernel maintenance.

Technical view

CVE-2025-68363 fixes bpf_skb_check_mtu when BPF_MTU_CHK_SEGS is used. The helper could use skb->transport_header when it was unset, triggering WARN_ON_ONCE with CONFIG_DEBUG_NET, skb->gso_size, and bpf_prog_test_run. The fix checks skb_transport_header_was_set() immediately before using the transport header.

Likely exposure

Potential exposure is limited to Linux systems with affected kernel builds containing this BPF helper behavior. Confirm exposure through the exact kernel version, distribution backports, and any vendor advisory, including Siemens SSA-019113 where applicable.

Exploitation context

No active exploitation is supported by the source bundle. KEV is false, and the provided kernel description discusses a warning observed in test-run conditions rather than a documented attack path.

Researcher notes

Evidence is narrow: the described observable behavior is WARN_ON_ONCE in bpf_prog_test_run with specific skb state. The source bundle does not provide CVSS, CWE, exploitability, privilege requirements, or concrete product impact beyond Linux and a Siemens advisory reference.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable kernel fixes.
  • Check distribution and appliance vendor advisories for backported fixes.
  • Review Siemens SSA-019113 if Siemens products are in scope.
  • Use existing BPF hardening policy until vendor guidance is confirmed.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Map installed kernels to vendor-fixed builds or referenced stable commits.
  • Check whether CONFIG_DEBUG_NET and BPF test-run functionality are present.
  • Verify Siemens product exposure against SSA-019113 where relevant.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68363 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux34b2021cc61642d61c3cf943d9e71925b827941b, 34b2021cc61642d61c3cf943d9e71925b827941b, 34b2021cc61642d61c3cf943d9e71925b827941b, 34b2021cc61642d61c3cf943d9e71925b827941b, 34b2021cc61642d61c3cf943d9e71925b827941b, 34b2021cc61642d61c3cf943d9e71925b827941bunaffected
LinuxLinux5.12, 0, 6.1.160, 6.6.120, 6.12.63, 6.17.13, 6.18.2, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.