CVE-2025-68353

What it actually does

NULL pointer dereference in vxlan_xmit_one when sock4 or sock6 are invalid (e.g., interface down), causing kernel oops during VXLAN transmit path.

Why it matters to the business

Unexpected kernel crashes on systems using VXLAN networking can lead to service outages, loss of network connectivity, and require manual reboots or restarts, increasing operational overhead especially on high-availability or containerized environments.

How an attack unfolds

An attacker with the ability to influence network interface state or VXLAN configuration triggers the transmit path under conditions where socket pointers are NULL, resulting in a kernel panic; no authenticated remote code execution is indicated.

How to fix it

Update the Linux kernel to a version containing commit 4ac26aafdc8c7271414e2e7c0b2cb266a26591bc or later; rebuild and deploy affected images such as prometheus-pushgateway-fips to version 1.11.0-r4 or newer.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable release; reproduce interface-down scenarios while monitoring for absence of the described NULL dereference oops in dmesg or kernel logs.

Typical attack path

1. Identify or configure a system using VXLAN interfaces
2. Bring the relevant network interface down or manipulate routing state
3. Trigger packet transmission through the VXLAN device
4. Cause vxlan_xmit_one to dereference a NULL sock pointer
5. Induce kernel NULL pointer dereference and system crash

How to detect it

Search kernel logs and dmesg for NULL pointer dereference oops with stack traces containing vxlan_xmit_one, vxlan_xmit, and related IP output functions; correlate with recent interface state changes.

• BUG: kernel NULL pointer dereference, address: 0000000000000010
• vxlan_xmit_one+0xbb3/0x1580
• vxlan_xmit+0x429/0x610
• Oops: Oops: 0000 [#1] SMP NOPTI

What your security team should do

• Prioritize kernel updates on all systems using VXLAN
• Monitor for kernel oops involving vxlan_xmit_one
• Test interface state changes in staging environments before production rollout
• Review downstream package dependencies for the fixed commit