CVE-2025-68725

What it actually does

The vulnerability allows the BPF test infrastructure to invoke bpf_clone_redirect() with packets that have gso_segs and gso_size set but gso_type unset, producing malformed GSO metadata that reaches gso_features_check() and triggers skb_warn_bad_offload(), disabling offload features.

Why it matters to the business

Systems running affected Linux kernels or dependent products such as tigera-operator may experience spurious network offload warnings and degraded packet-processing performance during BPF test operations; the issue is present in widely deployed kernel trees with hundreds of downstream dependents.

How an attack unfolds

An attacker with local access loads a BPF program via the test infrastructure that calls bpf_clone_redirect() to the loopback device; the missing gso_type field causes the kernel to emit an invalid GSO packet, triggering the warning path and disabling GSO features for subsequent traffic.

How to fix it

Upgrade to a fixed kernel containing commit bb7902ed7d7f6d6a7c6c4dc25410d6127ce1085f or install tigera-operator-1.28.15-r18; rebuild and reboot any affected systems; disable unneeded BPF test infrastructure where feasible until patches are applied.

How to confirm the fix worked

Verify the running kernel contains commit bb7902ed7d7f6d6a7c6c4dc25410d6127ce1085f or later; confirm tigera-operator reports version 1.28.15-r18 or newer; reproduce a BPF redirect test and ensure no skb_warn_bad_offload() messages appear.

Typical attack path

1. Obtain local access to a system running an affected kernel
2. Load a BPF program through the test infrastructure that performs bpf_clone_redirect()
3. Send crafted packets that set gso_segs/gso_size without gso_type
4. Observe skb_warn_bad_offload() and resulting GSO feature disablement

How to detect it

Search kernel logs and dmesg for skb_warn_bad_offload() messages originating from netif_skb_features(); correlate with processes invoking BPF test programs or bpf_clone_redirect() on loopback.

• skb_warn_bad_offload
• gso_features_check
• convert___skb_to_skb

What your security team should do

• Apply the listed fixed versions immediately on all affected hosts
• Prioritize patching systems that expose BPF test interfaces to untrusted users
• Monitor kernel logs for skb_warn_bad_offload() entries as an interim detection measure
• Review and restrict use of bpf_clone_redirect() in test environments