Security readout for executives and security teams
Plain-English summary
A malformed packet sent to a Linux CAIF interface configured without FCS can trigger a length-calculation underflow. The resulting kernel behavior may exhaust memory or destabilize the system, and could disclose uninitialized kernel data. Risk is concentrated in systems that actually use reachable CAIF networking with FCS disabled; an ordinary Linux deployment alone does not establish exploitability.
Executive priority
Prioritize promptly where CAIF is enabled and reachable, especially on availability-sensitive or data-sensitive systems. For systems without CAIF or the FCS-disabled condition, urgency is lower after verification. This is a high-severity, configuration-dependent issue, not evidence of a broadly internet-reachable Linux flaw.
Technical view
In cffrml_receive(), the kernel subtracts two from a packet-supplied length when FCS is disabled. Values zero or one underflow, potentially causing excessive memory use, instability, and disclosure through uninitialized padding. The upstream fix rejects lengths below two before subtraction. CVSS 3.1 is 8.1, requiring adjacent access but no privileges or user interaction.
Likely exposure
Exposure requires an affected Linux kernel, an active CAIF receive path, FCS disabled, and an attacker able to deliver traffic to that interface. The supplied record references releases from 2.6.35 through 6.19, but its range semantics are unclear. Validate against distribution guidance and the listed stable-kernel fixes rather than relying on version strings alone.
Exploitation context
KEV is false, and the supplied sources do not report active exploitation. Exploitation is configuration-dependent and requires adjacent delivery of a malformed packet to a CAIF interface with FCS disabled. The sources describe availability and possible confidentiality impact, but no integrity impact or remote internet attack path.
Researcher notes
Review the exact cffrml_receive() path and backport status. The decisive vulnerable condition is subtraction before confirming len is at least two when FCS is disabled. The bundle identifies possible uninitialized-padding disclosure but provides no demonstrated exploit, proof of concept, configuration-prevalence data, or clear distribution-specific fixed-version mapping.
Mitigation direction
- Apply the applicable Linux stable fix or a downstream vendor kernel containing the length validation.
- Review your Linux distributor's advisory to identify the correct fixed package for each deployed kernel.
- Where operationally safe, disable unused CAIF interfaces and confirm the temporary mitigation with the vendor.
- Restrict untrusted adjacent access to systems exposing CAIF until remediation is verified.
Validation and detection
- Inventory deployed Linux kernels and determine whether CAIF is enabled and actively used.
- Identify CAIF interfaces operating with FCS disabled and document reachable adjacent actors.
- Confirm each relevant kernel contains an applicable upstream fix or downstream backport.
- Review monitoring for unexplained kernel instability, memory exhaustion, crashes, or potential data exposure.
- After remediation, verify normal CAIF traffic remains functional and malformed short lengths are rejected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68799 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H2.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f407f1c9f45bbf5c99fd80b3f3f4a94fdbe35691CVE reference, Linux
- https://git.kernel.org/stable/c/c54091eec6fed19e94182aa05dd6846600a642f7CVE reference, Linux
- https://git.kernel.org/stable/c/785c7be6361630070790f6235b696da156ac71b3CVE reference, Linux
- https://git.kernel.org/stable/c/f818cd472565f8b0c2c409b040e0121c5cf8592cCVE reference, Linux
- https://git.kernel.org/stable/c/4ec29714aa4e0601ea29d2f02b461fc0ac92c2c3CVE reference, Linux
- https://git.kernel.org/stable/c/21fdcc00656a60af3c7aae2dea8dd96abd35519cCVE reference, Linux
- https://git.kernel.org/stable/c/8a11ff0948b5ad09b71896b7ccc850625f9878d1CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.