CVE-2025-68795

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ethtool: Avoid overflowing userspace buffer on stats query

The ethtool -S command operates across three ioctl calls:

ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and

ETHTOOL_GSTATS for the values.

If the number of stats changes between these calls (e.g., due to device

reconfiguration), userspace's buffer allocation will be incorrect,

potentially leading to buffer overflow.

Drivers are generally expected to maintain stable stat counts, but some

drivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making

this scenario possible.

Some drivers try to handle this internally:

- bnad_get_ethtool_stats() returns early in case stats.n_stats is not

equal to the driver's stats count.

- micrel/ksz884x also makes sure not to write anything beyond

stats.n_stats and overflow the buffer.

However, both use stats.n_stats which is already assigned with the value

returned from get_sset_count(), henc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References