AZL-73135
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-73135.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-73135
- Upstream
- Published
- 2025-12-24T11:15:59Z
- Modified
- 2026-04-01T05:22:15.566852Z
- Summary
- CVE-2025-68363 affecting package kernel for versions less than 6.6.121.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check skb->transportheader is set in bpfskbcheckmtu
The bpfskbcheckmtu helper needs to use skb->transportheader when the BPFMTUCHK_SEGS flag is used:
bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)The transportheader is not always set. There is a WARNONONCE report when CONFIGDEBUGNET is enabled + skb->gsosize is set + bpfprogtest_run is used:
WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skbgsovalidatenetworklen bpfskbcheckmtu bpfprog3920e25740a41171tcchksegsflag # A test in the next patch bpftestrun bpfprogtestrun_skb
For a normal ingress skb (not testrun), skbresettransportheader is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in _netifreceiveskbcore()").
This patch fixes the bpf helper by checking skbtransportheaderwasset(). The check is done just before skb->transportheader is used, to avoid breaking the existing bpf prog. The WARNONONCE is limited to bpfprogtestrun, so targeting bpf-next.
- References