CVE-2025-68363

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check skb->transport_header is set in bpf_skb_check_mtu

The bpf_skb_check_mtu helper needs to use skb->transport_header when

the BPF_MTU_CHK_SEGS flag is used:

bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS)

The transport_header is not always set. There is a WARN_ON_ONCE

report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set +

bpf_prog_test_run is used:

WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071

skb_gso_validate_network_len

bpf_skb_check_mtu

bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch

bpf_test_run

bpf_prog_test_run_skb

For a normal ingress skb (not test_run), skb_reset_transport_header

is performed but there is plan to avoid setting it as described in

commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()").

This patch fixes the bpf helper by checking

skb_transport_header_was_set(). The check is done ju

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References