CVE-2025-68768

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: flush pending skbs in fqdir_pre_exit()

We have been seeing occasional deadlocks on pernet_ops_rwsem since

September in NIPA. The stuck task was usually modprobe (often loading

a driver like ipvlan), trying to take the lock as a Writer.

lockdep does not track readers for rwsems so the read wasn't obvious

from the reports.

On closer inspection the Reader holding the lock was conntrack looping

forever in nf_conntrack_cleanup_net_list(). Based on past experience

with occasional NIPA crashes I looked thru the tests which run before

the crash and noticed that the crash follows ip_defrag.sh. An immediate

red flag. Scouring thru (de)fragmentation queues reveals skbs sitting

around, holding conntrack references.

The problem is that since conntrack depends on nf_defrag_ipv6,

nf_defrag_ipv6 will load first. Since nf_defrag_ipv6 loads first its

netns exit hooks run _after_ conntrack's netns exit hook.

Flush all f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References