CVE-2025-68206

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: add seqadj extension for natted connections

Sequence adjustment may be required for FTP traffic with PASV/EPSV modes.

due to need to re-write packet payload (IP, port) on the ftp control

connection. This can require changes to the TCP length and expected

seq / ack_seq.

The easiest way to reproduce this issue is with PASV mode.

Example ruleset:

table inet ftp_nat {

ct helper ftp_helper {

type "ftp" protocol tcp

l3proto inet

}

chain prerouting {

type filter hook prerouting priority 0; policy accept;

tcp dport 21 ct state new ct helper set "ftp_helper"

}

}

table ip nat {

chain prerouting {

type nat hook prerouting priority -100; policy accept;

tcp dport 21 dnat ip prefix to ip daddr map {

192.168.100.1 : 192.168.13.2/32 }

}

chain postrouting {

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References