CVE-2025-68200

What it actually does

A BPF program attached via cls_bpf_classify can overwrite the drop_reason field inside the tc_skb_cb structure because net_sched storage collides with the BPF data_meta/data_end pointers that were wired in earlier; this produces an invalid state that later triggers a warning in sk_skb_reason_drop.

Why it matters to the business

Systems running affected Linux kernels or container images may emit kernel warnings during network packet classification with BPF programs; operational impact is limited to log noise and potential instability in high-throughput networking paths, with no known active exploitation or ransomware use.

How an attack unfolds

An attacker with the ability to load or influence a cls_bpf program can craft packet processing logic that collides with the tc_skb_cb storage, causing the drop_reason field to be altered and the subsequent warning path to be exercised.

How to fix it

Update the Linux kernel to 5.15.197 or newer; for the listed Kubernetes packages update to the 1.32.2-r0 releases (or equivalent) that contain the corrected kernel.

How to confirm the fix worked

Confirm the running kernel version is at or above the listed fixed releases; verify that BPF programs attached to tc classifiers no longer produce the sk_skb_reason_drop warning under the same traffic patterns.

Typical attack path

1. Obtain privileges to load or attach a cls_bpf classifier
2. Send or forward traffic that reaches the classifier
3. Trigger modification of the colliding tc_skb_cb field
4. Observe kernel warning in sk_skb_reason_drop

How to detect it

Search kernel logs for the string sk_skb_reason_drop and the associated WARNING at net/core/skbuff.c; review audit logs for unexpected cls_bpf program loads or attachments on systems using tc classifiers.

What your security team should do

• Prioritize kernel and Kubernetes package upgrades to the versions containing bpf_prog_run_data_pointers
• Monitor for sk_skb_reason_drop warnings in kernel logs on systems that use cls_bpf classifiers
• Apply updates within normal change windows given the absence of known exploitation