CVE-2025-68785: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-68785 Overview

A slab-out-of-bounds read vulnerability has been identified in the Linux kernel's Open vSwitch (OVS) module, specifically within the push_nsh() action handling. The vulnerability stems from missing validation of the middle attribute (OVS_KEY_ATTR_NSH) in the nested netlink attribute structure, allowing potential invalid memory access when processing Network Service Header (NSH) push operations.

Critical Impact

An attacker could trigger out-of-bounds memory reads through malformed netlink messages, potentially leading to information disclosure or kernel crashes. The vulnerability is exploitable through the netlink interface used to configure Open vSwitch flows.

Affected Products

• Linux kernel with Open vSwitch (openvswitch) module enabled
• Systems using OVS for network virtualization and SDN

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-68785 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-68785

Vulnerability Analysis

The vulnerability exists in how the Open vSwitch kernel module processes OVS_ACTION_ATTR_PUSH_NSH actions. The action structure uses nested netlink attributes in a three-level hierarchy:

1. OVS_ACTION_ATTR_PUSH_NSH (outermost)
2. OVS_KEY_ATTR_NSH (middle)
3. OVS_NSH_KEY_ATTR_BASE/MD1/MD2 (innermost)

While the outermost attribute is validated by nla_for_each_nested() inside __ovs_nla_copy_actions(), and the innermost attributes are validated by nla_for_each_nested() inside nsh_key_put_from_nlattr(), the middle OVS_KEY_ATTR_NSH attribute lacks proper validation. The code performs a double unwrap using nla_data() calls without verifying that the middle attribute is correctly sized or even that it is an OVS_KEY_ATTR_NSH attribute.

Root Cause

The root cause is insufficient input validation in the netlink attribute parsing code. When processing the push_nsh() action, the kernel directly unwraps nested attributes without checking if the middle attribute's size is correct. During the initial validation phase, the failure may go unnoticed because the netlink buffer is larger than needed. However, during action execution, when the buffer is allocated exactly to the required size, attempting to access beyond the valid memory region triggers a KASAN (Kernel Address Sanitizer) detected slab-out-of-bounds error.

Attack Vector

An attacker with access to the netlink interface (typically requiring CAP_NET_ADMIN capability or root privileges) can craft a malicious netlink message containing an improperly sized OVS_KEY_ATTR_NSH attribute within an OVS_ACTION_ATTR_PUSH_NSH action. When this malformed action is executed via the ovs_packet_cmd_execute path, the nsh_hdr_from_nlattr() function attempts to copy memory based on the expected size rather than the actual attribute size, resulting in an out-of-bounds read from kernel slab memory.

The KASAN report from the CVE description shows the vulnerable code path:

• nsh_hdr_from_nlattr() performs an unsafe memcpy operation
• Called from push_nsh() in the openvswitch module
• Triggered through do_execute_actions() → ovs_execute_actions() → ovs_packet_cmd_execute()
• Accessible via the generic netlink interface (genl_rcv_msg)

Detection Methods for CVE-2025-68785

Indicators of Compromise

• KASAN reports showing slab-out-of-bounds reads in nsh_hdr_from_nlattr() function
• Kernel panic or oops messages originating from the openvswitch module
• Unexpected memory access errors in kernel logs related to netlink processing
• Suspicious netlink traffic patterns targeting the Open vSwitch generic netlink family

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in development and testing environments to detect out-of-bounds memory access attempts
• Monitor kernel logs for openvswitch module errors using tools like dmesg or centralized logging
• Deploy kernel live patching solutions to detect exploitation attempts against known vulnerable functions
• Implement netlink traffic monitoring to identify malformed OVS configuration messages

Monitoring Recommendations

• Configure audit rules to monitor CAP_NET_ADMIN capability usage and netlink socket operations
• Set up alerting for kernel oops or panic events specifically involving the openvswitch module
• Monitor for unusual Open vSwitch flow rule modifications or packet execution commands
• Use SentinelOne Singularity platform to detect kernel-level anomalies and potential exploitation attempts

How to Mitigate CVE-2025-68785

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix for CVE-2025-68785
• Restrict access to systems running Open vSwitch to trusted administrators only
• Review and audit any custom OVS flow rules or configurations for potentially malicious entries
• Consider temporarily disabling the openvswitch module if not actively required

Patch Information

The Linux kernel developers have released patches to address this vulnerability. The fix adds proper validation checks to ensure the middle attribute is correctly sized and is the only attribute inside the action. Multiple patch commits have been applied to the stable kernel branches:

• Kernel Git Commit 10ffc55
• Kernel Git Commit 1b569db
• Kernel Git Commit 2ecfc44
• Kernel Git Commit 5ace7ef
• Kernel Git Commit c999153

Workarounds

• Restrict netlink socket access by limiting CAP_NET_ADMIN capabilities to only essential processes
• Implement network namespace isolation to limit the scope of potential exploitation
• Deploy mandatory access control (MAC) policies using SELinux or AppArmor to restrict openvswitch module interactions
• Monitor and rate-limit generic netlink messages to the Open vSwitch family

# Configuration example - Restrict CAP_NET_ADMIN capability
# Review processes with network admin capabilities
getcap -r / 2>/dev/null | grep cap_net_admin

# Remove unnecessary CAP_NET_ADMIN from binaries
setcap -r /path/to/unnecessary/binary

# Use systemd to restrict capabilities for OVS services
# In /etc/systemd/system/openvswitch-switch.service.d/security.conf
# [Service]
# CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
# NoNewPrivileges=true