Skip to main content
VulnerabilityPublished Updated

CVE-2025-68787: Linux kernel · netrom: Fix memory leak in nr_sendmsg()

Affects Linux kernelSource CVE Database V5

0
Compare

Not known to be exploited · fixed in f77e538ac4e3adb1882d5bccb7bfdc111b5963d3 : update Linux kernel when convenient.

Data as of 10 Nov 2026, 13:18 UTC

Severity
Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none
Patch
Available – fixed in f77e538ac4e3adb1882d5bccb7bfdc111b5963d3, 73839497bbde5cd4fd02bbd9c8bc2640780ae65d, 613d12dd794e078be8ff3cf6b62a6b9acf7f4619 +4

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 13 Jan 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 10 Nov 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f77e538ac4e3adb1882d5bccb7bfdc111b5963d3
Fixed in
  • f77e538ac4e3adb1882d5bccb7bfdc111b5963d3
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 73839497bbde5cd4fd02bbd9c8bc2640780ae65d
Fixed in
  • 73839497bbde5cd4fd02bbd9c8bc2640780ae65d
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 613d12dd794e078be8ff3cf6b62a6b9acf7f4619
Fixed in
  • 613d12dd794e078be8ff3cf6b62a6b9acf7f4619
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 156a0f6341dce634a825db49ca20b48b1ae9bcc1
Fixed in
  • 156a0f6341dce634a825db49ca20b48b1ae9bcc1
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 51f5fbc1681bdcffcc7d18bf3dfdb2b1278d3977
Fixed in
  • 51f5fbc1681bdcffcc7d18bf3dfdb2b1278d3977
LinuxLinuxAffected
  • ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 09efbf54eeaecebe882af603c9939a4b1bb9567e
Fixed in
  • 09efbf54eeaecebe882af603c9939a4b1bb9567e

AI-suggested

The vulnerability has been fixed in the Linux kernel. Users and administrators should apply the official patches or update to a fixed kernel version containing the listed commits. Since this is a memory leak fix, no additional mitigation steps are necessary beyond applying the patch.

Description

A memory leak vulnerability was identified and fixed in the Linux kernel's netrom module in the nr_sendmsg() function. The issue occurs when sock_alloc_send_skb() returns NULL in nr_output(), causing the originally allocated socket buffer (skb) not to be freed. This flaw was reported by syzbot and has been addressed by freeing the skb before returning.

References

Community reviews

Loading reviews…