Security readout for executives and security teams
Plain-English summary
CVE-2025-68787 is a Linux kernel memory leak in the NET/ROM networking code. Under an allocation failure path, memory allocated for a socket buffer is not released. The available sources do not provide a CVSS score or show active exploitation.
Executive priority
Treat as a kernel maintenance priority, not an emergency, unless affected kernels are widely deployed in critical or embedded environments. Lack of CVSS and exploitation evidence lowers urgency, but kernel availability issues still deserve scheduled remediation.
Technical view
In nr_sendmsg()/nr_output(), if sock_alloc_send_skb() returns NULL, the original skb allocated earlier is not freed. The Linux fix releases that skb before returning. The report came from syzbot/kmemleak evidence, indicating a leak rather than proven code execution.
Likely exposure
Exposure appears limited to Linux kernels containing the affected NET/ROM implementation. The bundle lists affected Linux versions and multiple stable kernel fix commits. Siemens also published an advisory, so downstream products should be checked through vendor guidance.
Exploitation context
The bundle does not cite KEV listing, public exploitation, exploit code, or weaponization. Practical impact is most plausibly availability/resource exhaustion if a reachable local or permitted network path can repeatedly trigger the leak, but exploitability details are incomplete.
Researcher notes
Evidence is strongest for a memory leak discovered by syzbot. The affected-version data is broad and commit-based, so researchers should map fixes through kernel stable branches or distribution backports before asserting exposure.
Mitigation direction
Update to a Linux kernel containing the referenced stable fix commits.
Track distribution kernel advisories for backported CVE-2025-68787 fixes.
Review the Siemens advisory if operating Siemens products or appliances.
If immediate patching is unavailable, follow vendor guidance for supported risk reduction.
Validation and detection
Inventory Linux kernel versions against vendor advisories for CVE-2025-68787.
Confirm whether NET/ROM support is present and operationally required.
Verify installed kernel packages include the relevant stable fix or vendor backport.
Monitor vendor advisories for any later severity, exploitability, or mitigation updates.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-68787 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
1ADP providers
9Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Jan 13, 2026, 15:29 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.