CVE-2025-68232

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

veth: more robust handing of race to avoid txq getting stuck

Commit dc82a33297fc ("veth: apply qdisc backpressure on full ptr_ring to

reduce TX drops") introduced a race condition that can lead to a permanently

stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra

Max).

The race occurs in veth_xmit(). The producer observes a full ptr_ring and

stops the queue (netif_tx_stop_queue()). The subsequent conditional logic,

intended to re-wake the queue if the consumer had just emptied it (if

(__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a

"lost wakeup" where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and

traffic halts.

This failure is caused by an incorrect use of the __ptr_ring_empty() API

from the producer side. As noted in kernel comments, this check is not

guaranteed to be correct if a consumer is operating on another CPU. The

empty test is based on ptr_ring->consume

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References