CVE-2025-68787

What it actually does

Failure to free an skb allocated in nr_sendmsg() when sock_alloc_send_skb() returns NULL inside nr_output(), causing a memory leak in the NET/ROM protocol implementation.

Why it matters to the business

Gradual memory exhaustion on Linux systems that use the NET/ROM amateur radio protocol stack, potentially leading to degraded performance or denial of service under sustained load; low urgency given minimal exploitability and low EPSS.

How an attack unfolds

An attacker triggers the error path in nr_sendmsg() by inducing memory pressure that causes sock_alloc_send_skb() to fail, leaving the previously allocated skb unfreed and accumulating leaked objects over repeated invocations.

How to fix it

Apply the upstream fix in commit f77e538ac4e3adb1882d5bccb7bfdc111b5963d3 or upgrade to a Linux kernel version containing this commit; disable NET/ROM (CONFIG_NETROM) if the protocol is unused.

How to confirm the fix worked

Verify the presence of commit f77e538ac4e3adb1882d5bccb7bfdc111b5963d3 in the kernel source; run kmemleak or memory usage monitoring under synthetic load that exercises nr_sendmsg() to confirm absence of leaks.

Typical attack path

1. Establish a NET/ROM socket and begin sending messages
2. Induce system memory pressure to force sock_alloc_send_skb() failure
3. Repeat send operations to trigger repeated leaks without freeing the original skb
4. Observe cumulative memory consumption until system impact occurs

How to detect it

Enable kernel kmemleak and search for unreferenced skb objects with backtraces containing nr_sendmsg and sock_alloc_send_skb; monitor overall memory usage trends correlated with NET/ROM socket activity.

What your security team should do

• Patch affected Linux kernels to the fixed commit at the earliest maintenance window
• Audit systems for NET/ROM usage and disable the module where unnecessary
• Monitor EPSS trend and re-evaluate if exploit maturity increases