{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-68192", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.253Z", "datePublished": "2025-12-16T13:43:18.858Z", "dateUpdated": "2026-08-05T12:10:09.585Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:09.585Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb->mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n Internal error: Oops: 000000009600004f [#1] SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n Hardware name: LS1028A RDB Board (DT)\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : xfrm_input+0xde8/0x1318\n lr : xfrm_input+0x61c/0x1318\n sp : ffff800080003b20\n Call trace:\n xfrm_input+0xde8/0x1318\n xfrm6_rcv+0x38/0x44\n xfrm6_esp_rcv+0x48/0xa8\n ip6_protocol_deliver_rcu+0x94/0x4b0\n ip6_input_finish+0x44/0x70\n ip6_input+0x44/0xc0\n ipv6_rcv+0x6c/0x114\n __netif_receive_skb_one_core+0x5c/0x8c\n __netif_receive_skb+0x18/0x60\n process_backlog+0x78/0x17c\n __napi_poll+0x38/0x180\n net_rx_action+0x168/0x2f0" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The corrupted skb is built from IP packets received over the cellular/WWAN network and the trigger is a remotely-sourced ESP or IP-in-IP packet processed by xfrm_input on the qmimux interface. The attacker is an arbitrary remote host on the network side; no local or physical access to the device is needed.\nAC:L - On any affected kernel with QMAP mux (the standard ModemManager setup for QMI modems) and IPsec over the WWAN link, every tunnel-mode packet deterministically executes the out-of-bounds write with no race to win and no memory-layout luck required. The attacker can repeat it per packet and choose the written value via the inner IP version.\nPR:N - The xfrm tunnel type ipip_xfrm_rcv() performs no cryptographic verification at all and its SA is matched by source address, so a spoofed IP-in-IP packet reaches the vulnerable decap with no credentials. Even in the ESP case the triggering peer holds no privileges or account on the target device.\nUI:N - The corruption occurs entirely in the NET_RX softirq receive path when a packet arrives. No action by any local user or administrator is required.\nS:U - The out-of-bounds write and the resulting crash are confined to the kernel's own memory and security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The bug is a genuine out-of-bounds heap write roughly 64KB past the skb buffer, and such corruption of an adjacent object's length/offset field is a standard route to kernel memory disclosure. The same uninitialized offset also feeds garbage skb->mac_len into tc/XDP paths that expose adjacent memory.\nI:H - eth_hdr(skb)->h_proto = skb->protocol writes 2 attacker-selectable bytes at a fixed skb->head + 65547, i.e. a page-groomable out-of-bounds write into an arbitrary neighbouring kernel page. Out-of-bounds writes are exploitable for control-flow hijacking, and here it can also silently corrupt live kernel objects without crashing.\nA:H - The reported ARM64 oops (write permission fault in xfrm_input, in softirq context) is reproduced by every received IPsec packet, and embedded/industrial routers typically run panic_on_oops, giving a full device outage. It is remotely and repeatably triggerable." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/usb/qmi_wwan.c" ], "versions": [ { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "d693c47fb902b988f5752182e4f7fbde5e6dcaf9", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "0aabccdcec1f4a36f95829ea2263f845bbc77223", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "4e6b9004f01d0fef5b19778399bc5bf55f8c2d71", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "bf527b80b80a282ab5bf1540546211fc35e5cd42", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "dd03780c29f87c26c0e0bb7e0db528c8109461fb", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "ae811175cea35b03ac6d7c910f43a82a43b9c3b3", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "8ab3b8f958d861a7f725a5be60769106509fbd69", "status": "affected", "versionType": "git" }, { "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "e120f46768d98151ece8756ebd688b0e43dc8b29", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/usb/qmi_wwan.c" ], "versions": [ { "version": "4.12", "status": "affected" }, { "version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.302", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.247", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.4.302" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.10.247" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.197" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.159" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.117" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.58" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.17.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d693c47fb902b988f5752182e4f7fbde5e6dcaf9" }, { "url": "https://git.kernel.org/stable/c/0aabccdcec1f4a36f95829ea2263f845bbc77223" }, { "url": "https://git.kernel.org/stable/c/4e6b9004f01d0fef5b19778399bc5bf55f8c2d71" }, { "url": "https://git.kernel.org/stable/c/bf527b80b80a282ab5bf1540546211fc35e5cd42" }, { "url": "https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb" }, { "url": "https://git.kernel.org/stable/c/ae811175cea35b03ac6d7c910f43a82a43b9c3b3" }, { "url": "https://git.kernel.org/stable/c/8ab3b8f958d861a7f725a5be60769106509fbd69" }, { "url": "https://git.kernel.org/stable/c/e120f46768d98151ece8756ebd688b0e43dc8b29" } ], "title": "net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup", "x_generator": { "engine": "bippy-1.2.0" } } } }