Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit… (CVE-2025-68341)
In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI this is correctly handled as the napi_schedule_prep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance. The problem/race is that xdp_clear_return_frame_no_direct() isn't designed to be nested. Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the temporary BPF net context bpf_redirect_info was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' task_struct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent veth_pool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context. Race is when another CPU gets within the xdp_set_return_frame_no_direct() section before exiting veth_pool() calls the clear-function xdp_clear_return_frame_no_direct().
AI Analysis
Technical Summary
CVE-2025-68341 describes a race condition in the Linux kernel's veth driver involving the XDP no_direct return section. The root cause is that after napi_complete_done(), another CPU can start a new NAPI instance running veth_pool() concurrently with the previous instance still executing. While NAPI scheduling prevents multiple instances from running simultaneously, the remaining code in veth_pool() can run concurrently, leading to a race. The function xdp_clear_return_frame_no_direct() is not designed for nested calls, and since the BPF net context bpf_redirect_info is now stored in the current task_struct (post commit 401cb7dae813), concurrent veth_pool() calls share this context, causing a race condition. This can result in exposure of old or uninitialized descriptors, potentially impacting kernel networking operations.
Potential Impact
The vulnerability can lead to race conditions in kernel networking code, potentially causing use of stale or uninitialized data structures related to BPF redirect information. This can impact confidentiality, integrity, and availability of the affected system, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel as described in the referenced commits. Since no explicit patch links or vendor advisories are provided, users should update to the latest Linux kernel versions that include the fix for CVE-2025-68341. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for current remediation guidance.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit… (CVE-2025-68341)
Description
In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix race As explain in commit fa349e396e48 ("veth: Fix race with AF_XDP exposing old or uninitialized descriptors") for veth there is a chance after napi_complete_done() that another CPU can manage start another NAPI instance running veth_pool(). For NAPI this is correctly handled as the napi_schedule_prep() check will prevent multiple instances from getting scheduled, but for the remaining code in veth_pool() this can run concurrent with the newly started NAPI instance. The problem/race is that xdp_clear_return_frame_no_direct() isn't designed to be nested. Prior to commit 401cb7dae813 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.") the temporary BPF net context bpf_redirect_info was stored per CPU, where this wasn't an issue. Since this commit the BPF context is stored in 'current' task_struct. When running veth in threaded-NAPI mode, then the kthread becomes the storage area. Now a race exists between two concurrent veth_pool() function calls one exiting NAPI and one running new NAPI, both using the same BPF net context. Race is when another CPU gets within the xdp_set_return_frame_no_direct() section before exiting veth_pool() calls the clear-function xdp_clear_return_frame_no_direct().
CVSS v3.1
Score 9.8critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-68341 describes a race condition in the Linux kernel's veth driver involving the XDP no_direct return section. The root cause is that after napi_complete_done(), another CPU can start a new NAPI instance running veth_pool() concurrently with the previous instance still executing. While NAPI scheduling prevents multiple instances from running simultaneously, the remaining code in veth_pool() can run concurrently, leading to a race. The function xdp_clear_return_frame_no_direct() is not designed for nested calls, and since the BPF net context bpf_redirect_info is now stored in the current task_struct (post commit 401cb7dae813), concurrent veth_pool() calls share this context, causing a race condition. This can result in exposure of old or uninitialized descriptors, potentially impacting kernel networking operations.
Potential Impact
The vulnerability can lead to race conditions in kernel networking code, potentially causing use of stale or uninitialized data structures related to BPF redirect information. This can impact confidentiality, integrity, and availability of the affected system, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel as described in the referenced commits. Since no explicit patch links or vendor advisories are provided, users should update to the latest Linux kernel versions that include the fix for CVE-2025-68341. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-68w5-72rc-pgrc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-68341"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a6b72d29c2644c7f8477ce5
Added to database: 07/30/2026, 15:50:42 UTC
Last enriched: 07/30/2026, 18:52:15 UTC
Last updated: 09/10/2026, 19:24:57 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.