CVE-2025-68724

What it actually does

Integer overflow check missing in asymmetric_key_generate_id allows attacker-controlled X.509 fields (serial numbers, issuer names) to cause buffer overflow when constructing asymmetric_key_id structures.

Why it matters to the business

Systems processing untrusted certificates may experience kernel crashes, memory corruption, or potential code execution, leading to service outages or full host compromise in certificate-handling workloads.

How an attack unfolds

An attacker supplies a crafted X.509 certificate containing oversized ASN.1 fields to a Linux kernel component that calls asymmetric_key_generate_id; the missing overflow check permits a buffer overflow during length calculations and data copying.

How to fix it

Update affected packages to the listed fixed versions: cluster-autoscaler-1.28 and cluster-autoscaler-1.28-compat to 1.28.7-r7; Linux kernel to commit 60a7be5ee74408147e439164ac067e418ca74bb4 or later stable releases containing the check_add_overflow guard.

How to confirm the fix worked

Verify the presence of the check_add_overflow call and ERR_PTR(-EOVERFLOW) return path in asymmetric_key_generate_id after applying the update; confirm kernel builds contain commit 60a7be5ee74408147e439164ac067e418ca74bb4.

Typical attack path

1. Obtain or generate a malicious X.509 certificate with arbitrarily large serial number or issuer fields
2. Deliver the certificate to a vulnerable kernel path that invokes asymmetric key ID generation
3. Trigger the integer overflow during length summation of blob and structure sizes
4. Overwrite adjacent kernel memory during the subsequent copy operation

How to detect it

Review kernel logs for unexpected EOVERFLOW returns from asymmetric key operations or crashes in crypto/asymmetric_keys code paths; inspect certificate ingestion points for malformed inputs preceding any failure.

What your security team should do

• Apply the kernel and autoscaler updates immediately on all affected systems
• Prioritize certificate-processing workloads and any systems accepting external X.509 material
• Monitor for downstream package updates that pull in the fixed kernel commit