CVE-2025-68192

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68192", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T13:41:40.253Z", "datePublished": "2025-12-16T13:43:18.858Z", "dateUpdated": "2026-10-15T22:02:47.413Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:09.585Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb->mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n Internal error: Oops: 000000009600004f [#1] SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n Hardware name: LS1028A RDB Board (DT)\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : xfrm_input+0xde8/0x1318\n lr : xfrm_input+0x61c/0x1318\n sp : ffff800080003b20\n Call trace:\n xfrm_input+0xde8/0x1318\n xfrm6_rcv+0x38/0x44\n xfrm6_esp_rcv+0x48/0xa8\n ip6_protocol_deliver_rcu+0x94/0x4b0\n ip6_input_finish+0x44/0x70\n ip6_input+0x44/0xc0\n ipv6_rcv+0x6c/0x114\n __netif_receive_skb_one_core+0x5c/0x8c\n __netif_receive_skb+0x18/0x60\n process_backlog+0x78/0x17c\n __napi_poll+0x38/0x180\n net_rx_action+0x168/0x2f0"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The corrupted skb is built from IP packets received over the cellular/WWAN network and the trigger is a remotely-sourced ESP or IP-in-IP packet processed by xfrm_input on the qmimux interface. The attacker is an arbitrary remote host on the network side; no local or physical access to the device is needed.\nAC:L - On any affected kernel with QMAP mux (the standard ModemManager setup for QMI modems) and IPsec over the WWAN link, every tunnel-mode packet deterministically executes the out-of-bounds write with no race to win and no memory-layout luck required. The attacker can repeat it per packet and choose the written value via the inner IP version.\nPR:N - The xfrm tunnel type ipip_xfrm_rcv() performs no cryptographic verification at all and its SA is matched by source address, so a spoofed IP-in-IP packet reaches the vulnerable decap with no credentials. Even in the ESP case the triggering peer holds no privileges or account on the target device.\nUI:N - The corruption occurs entirely in the NET_RX softirq receive path when a packet arrives. No action by any local user or administrator is required.\nS:U - The out-of-bounds write and the resulting crash are confined to the kernel's own memory and security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The bug is a genuine out-of-bounds heap write roughly 64KB past the skb buffer, and such corruption of an adjacent object's length/offset field is a standard route to kernel memory disclosure. The same uninitialized offset also feeds garbage skb->mac_len into tc/XDP paths that expose adjacent memory.\nI:H - eth_hdr(skb)->h_proto = skb->protocol writes 2 attacker-selectable bytes at a fixed skb->head + 65547, i.e. a page-groomable out-of-bounds write into an arbitrary neighbouring kernel page. Out-of-bounds writes are exploitable for control-flow hijacking, and here it can also silently corrupt live kernel objects without crashing.\nA:H - The reported ARM64 oops (write permission fault in xfrm_input, in softirq context) is reproduced by every received IPsec packet, and embedded/industrial routers typically run panic_on_oops, giving a full device outage. It is remotely and repeatably triggerable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/usb/qmi_wwan.c"], "versions": [{"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "d693c47fb902b988f5752182e4f7fbde5e6dcaf9", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "0aabccdcec1f4a36f95829ea2263f845bbc77223", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "4e6b9004f01d0fef5b19778399bc5bf55f8c2d71", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "bf527b80b80a282ab5bf1540546211fc35e5cd42", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "dd03780c29f87c26c0e0bb7e0db528c8109461fb", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "ae811175cea35b03ac6d7c910f43a82a43b9c3b3", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "8ab3b8f958d861a7f725a5be60769106509fbd69", "status": "affected", "versionType": "git"}, {"version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "e120f46768d98151ece8756ebd688b0e43dc8b29", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/usb/qmi_wwan.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.302", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.247", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.197", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.159", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.4.302"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.10.247"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.197"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.159"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.58"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d693c47fb902b988f5752182e4f7fbde5e6dcaf9"}, {"url": "https://git.kernel.org/stable/c/0aabccdcec1f4a36f95829ea2263f845bbc77223"}, {"url": "https://git.kernel.org/stable/c/4e6b9004f01d0fef5b19778399bc5bf55f8c2d71"}, {"url": "https://git.kernel.org/stable/c/bf527b80b80a282ab5bf1540546211fc35e5cd42"}, {"url": "https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb"}, {"url": "https://git.kernel.org/stable/c/ae811175cea35b03ac6d7c910f43a82a43b9c3b3"}, {"url": "https://git.kernel.org/stable/c/8ab3b8f958d861a7f725a5be60769106509fbd69"}, {"url": "https://git.kernel.org/stable/c/e120f46768d98151ece8756ebd688b0e43dc8b29"}], "title": "net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T22:00:01.190473Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:47.413Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68192", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T22:00:01.190473Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:00:03.847Z"}}], "cna": {"title": "net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The corrupted skb is built from IP packets received over the cellular/WWAN network and the trigger is a remotely-sourced ESP or IP-in-IP packet processed by xfrm_input on the qmimux interface. The attacker is an arbitrary remote host on the network side; no local or physical access to the device is needed.\nAC:L - On any affected kernel with QMAP mux (the standard ModemManager setup for QMI modems) and IPsec over the WWAN link, every tunnel-mode packet deterministically executes the out-of-bounds write with no race to win and no memory-layout luck required. The attacker can repeat it per packet and choose the written value via the inner IP version.\nPR:N - The xfrm tunnel type ipip_xfrm_rcv() performs no cryptographic verification at all and its SA is matched by source address, so a spoofed IP-in-IP packet reaches the vulnerable decap with no credentials. Even in the ESP case the triggering peer holds no privileges or account on the target device.\nUI:N - The corruption occurs entirely in the NET_RX softirq receive path when a packet arrives. No action by any local user or administrator is required.\nS:U - The out-of-bounds write and the resulting crash are confined to the kernel's own memory and security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The bug is a genuine out-of-bounds heap write roughly 64KB past the skb buffer, and such corruption of an adjacent object's length/offset field is a standard route to kernel memory disclosure. The same uninitialized offset also feeds garbage skb->mac_len into tc/XDP paths that expose adjacent memory.\nI:H - eth_hdr(skb)->h_proto = skb->protocol writes 2 attacker-selectable bytes at a fixed skb->head + 65547, i.e. a page-groomable out-of-bounds write into an arbitrary neighbouring kernel page. Out-of-bounds writes are exploitable for control-flow hijacking, and here it can also silently corrupt live kernel objects without crashing.\nA:H - The reported ARM64 oops (write permission fault in xfrm_input, in softirq context) is reproduced by every received IPsec packet, and embedded/industrial routers typically run panic_on_oops, giving a full device outage. It is remotely and repeatably triggerable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "d693c47fb902b988f5752182e4f7fbde5e6dcaf9", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "0aabccdcec1f4a36f95829ea2263f845bbc77223", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "4e6b9004f01d0fef5b19778399bc5bf55f8c2d71", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "bf527b80b80a282ab5bf1540546211fc35e5cd42", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "dd03780c29f87c26c0e0bb7e0db528c8109461fb", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "ae811175cea35b03ac6d7c910f43a82a43b9c3b3", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "8ab3b8f958d861a7f725a5be60769106509fbd69", "versionType": "git"}, {"status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "lessThan": "e120f46768d98151ece8756ebd688b0e43dc8b29", "versionType": "git"}], "programFiles": ["drivers/net/usb/qmi_wwan.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "unaffected", "version": "0", "lessThan": "4.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.302", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.247", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.197", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.159", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.117", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.58", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.8", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/usb/qmi_wwan.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d693c47fb902b988f5752182e4f7fbde5e6dcaf9"}, {"url": "https://git.kernel.org/stable/c/0aabccdcec1f4a36f95829ea2263f845bbc77223"}, {"url": "https://git.kernel.org/stable/c/4e6b9004f01d0fef5b19778399bc5bf55f8c2d71"}, {"url": "https://git.kernel.org/stable/c/bf527b80b80a282ab5bf1540546211fc35e5cd42"}, {"url": "https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb"}, {"url": "https://git.kernel.org/stable/c/ae811175cea35b03ac6d7c910f43a82a43b9c3b3"}, {"url": "https://git.kernel.org/stable/c/8ab3b8f958d861a7f725a5be60769106509fbd69"}, {"url": "https://git.kernel.org/stable/c/e120f46768d98151ece8756ebd688b0e43dc8b29"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb->mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n Internal error: Oops: 000000009600004f [#1] SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n Hardware name: LS1028A RDB Board (DT)\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : xfrm_input+0xde8/0x1318\n lr : xfrm_input+0x61c/0x1318\n sp : ffff800080003b20\n Call trace:\n xfrm_input+0xde8/0x1318\n xfrm6_rcv+0x38/0x44\n xfrm6_esp_rcv+0x48/0xa8\n ip6_protocol_deliver_rcu+0x94/0x4b0\n ip6_input_finish+0x44/0x70\n ip6_input+0x44/0xc0\n ipv6_rcv+0x6c/0x114\n __netif_receive_skb_one_core+0x5c/0x8c\n __netif_receive_skb+0x18/0x60\n process_backlog+0x78/0x17c\n __napi_poll+0x38/0x180\n net_rx_action+0x168/0x2f0"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.302", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.247", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.197", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.159", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.117", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.58", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.8", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "4.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:10:09.585Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68192", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:47.413Z", "dateReserved": "2025-12-16T13:41:40.253Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-16T13:43:18.858Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/usb/qmi_wwan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d693c47fb902b988f5752182e4f7fbde5e6dcaf9", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "0aabccdcec1f4a36f95829ea2263f845bbc77223", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "4e6b9004f01d0fef5b19778399bc5bf55f8c2d71", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "bf527b80b80a282ab5bf1540546211fc35e5cd42", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "dd03780c29f87c26c0e0bb7e0db528c8109461fb", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "ae811175cea35b03ac6d7c910f43a82a43b9c3b3", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "8ab3b8f958d861a7f725a5be60769106509fbd69", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}, {"lessThan": "e120f46768d98151ece8756ebd688b0e43dc8b29", "status": "affected", "version": "c6adf77953bcec0ad63d7782479452464e50f7a3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/usb/qmi_wwan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.302", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.247", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.197", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.159", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.117", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.58", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup\n\nRaw IP packets have no MAC header, leaving skb->mac_header uninitialized.\nThis can trigger kernel panics on ARM64 when xfrm or other subsystems\naccess the offset due to strict alignment checks.\n\nInitialize the MAC header to prevent such crashes.\n\nThis can trigger kernel panics on ARM when running IPsec over the\nqmimux0 interface.\n\nExample trace:\n\n Internal error: Oops: 000000009600004f [#1] SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n Hardware name: LS1028A RDB Board (DT)\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : xfrm_input+0xde8/0x1318\n lr : xfrm_input+0x61c/0x1318\n sp : ffff800080003b20\n Call trace:\n xfrm_input+0xde8/0x1318\n xfrm6_rcv+0x38/0x44\n xfrm6_esp_rcv+0x48/0xa8\n ip6_protocol_deliver_rcu+0x94/0x4b0\n ip6_input_finish+0x44/0x70\n ip6_input+0x44/0xc0\n ipv6_rcv+0x6c/0x114\n __netif_receive_skb_one_core+0x5c/0x8c\n __netif_receive_skb+0x18/0x60\n process_backlog+0x78/0x17c\n __napi_poll+0x38/0x180\n net_rx_action+0x168/0x2f0"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: qmi_wwan: inicializar el desplazamiento del encabezado MAC en qmimux_rx_fixup\n\nLos paquetes IP sin procesar no tienen encabezado MAC, dejando skb -> mac_header sin inicializar. Esto puede desencadenar p\u00e1nicos del kernel en ARM64 cuando xfrm u otros subsistemas acceden al desplazamiento debido a estrictas comprobaciones de alineaci\u00f3n.\n\nInicializar el encabezado MAC para prevenir tales fallos.\n\nEsto puede desencadenar p\u00e1nicos del kernel en ARM al ejecutar IPsec sobre la interfaz qmimux0.\n\nTraza de ejemplo:\n\n Internal error: Oops: 000000009600004f [#1] SMP\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1\n Hardware name: LS1028A RDB Board (DT)\n pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : xfrm_input+0xde8/0x1318\n lr : xfrm_input+0x61c/0x1318\n sp : ffff800080003b20\n Call trace:\n xfrm_input+0xde8/0x1318\n xfrm6_rcv+0x38/0x44\n xfrm6_esp_rcv+0x48/0xa8\n ip6_protocol_deliver_rcu+0x94/0x4b0\n ip6_input_finish+0x44/0x70\n ip6_input+0x44/0xc0\n ipv6_rcv+0x6c/0x114\n __netif_receive_skb_one_core+0x5c/0x8c\n __netif_receive_skb+0x18/0x60\n process_backlog+0x78/0x17c\n __napi_poll+0x38/0x180\n net_rx_action+0x168/0x2f0"}], "id": "CVE-2025-68192", "lastModified": "2026-10-15T22:19:10.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68192", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T22:00:01.190473Z", "version": "2.0.3"}}]}, "published": "2025-12-16T14:15:51.900", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0aabccdcec1f4a36f95829ea2263f845bbc77223"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4e6b9004f01d0fef5b19778399bc5bf55f8c2d71"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ab3b8f958d861a7f725a5be60769106509fbd69"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae811175cea35b03ac6d7c910f43a82a43b9c3b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf527b80b80a282ab5bf1540546211fc35e5cd42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d693c47fb902b988f5752182e4f7fbde5e6dcaf9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd03780c29f87c26c0e0bb7e0db528c8109461fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e120f46768d98151ece8756ebd688b0e43dc8b29"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup", "id": "2422665", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2422665"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-68192", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68192\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68192\nhttps://lore.kernel.org/linux-cve-announce/2025121635-CVE-2025-68192-4491@gregkh/T"], "threat_severity": "Important"}

{}