The Linux kernel vulnerability CVE-2025-68795 involves the ethtool utility's -S command, which queries device statistics via three ioctl calls: ETHTOOL_GSSET_INFO, ETHTOOL_GSTRINGS, and ETHTOOL_GSTATS. If the number of statistics changes between these calls due to dynamic counters in certain drivers (e.g., mlx5, bnx2x, bna, ksz884x), userspace may allocate an incorrect buffer size, leading to a potential buffer overflow. Some drivers attempt partial mitigation, but these do not fully address the issue. The patch changes ethtool_get_strings(), ethtool_get_stats(), and ethtool_get_phy_stats() to return zero stats if a mismatch is detected, avoiding overflow. This results in either no stats output or all-zero stats temporarily, which is preferable to incorrect or shifted stats. The patch does not fix the inherent race condition but prevents overflow and improves predictability. The race window exists between ioctl calls when the RTNL lock is released.

The vulnerability can lead to a userspace buffer overflow when querying network device statistics with ethtool if the number of stats changes dynamically between ioctl calls. This could cause memory corruption in userspace applications using ethtool, potentially leading to crashes or other unintended behavior. The fix prevents buffer overflow by returning zero stats in case of mismatch, which may cause transient loss of stats output or zeroed stats but avoids presenting incorrect data. There are no known exploits in the wild. The impact is rated high due to potential confidentiality, integrity, and availability consequences from buffer overflow.

A fix has been implemented in the Linux kernel ethtool code to prevent userspace buffer overflow by returning zero stats when a size mismatch is detected during stats queries. This fix does not eliminate the underlying race condition but prevents overflow and improves behavior predictability. Users should update to a Linux kernel version that includes this patch once available. Until then, be aware that transient no-output or zeroed stats may occur during ethtool -S queries but this is preferable to buffer overflow. Monitor vendor advisories for the official patch release and apply it promptly.