Cloudanix VulnDB

CVE-2025-68795

None

CVSS

—

EPSS

0.2%

Published

Jan 13, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux network statistic reporting could let a local user cause memory problems when the number of available stats changes during a query.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race between ethtool ioctl calls (GSSET_INFO, GSTRINGS, GSTATS) allows stat count to change between allocation and copy, enabling buffer overflow in userspace stats buffer for drivers with dynamic counters.

Why it matters to the business

Local users on affected Linux kernels could trigger crashes or memory corruption during network stat queries; low practical risk but requires prompt patching on systems using mlx5, bnx2x, or similar drivers.

How an attack unfolds

An attacker issues sequential ethtool -S ioctls while triggering driver reconfiguration to alter stat counts between calls; the kernel previously copied beyond the userspace buffer size, now safely returns zero stats instead.

How to fix it

Upgrade the Linux kernel to include commit 3df375a1e75483b7d973c3cc2e46aa374db8428b which adds size-mismatch checks in ethtool_get_strings, ethtool_get_stats and ethtool_get_phy_stats.

How to confirm the fix worked

Confirm kernel contains commit 3df375a1e75483b7d973c3cc2e46aa374db8428b; run ethtool -S after forcing stat count changes and verify no overflow or kernel oops occurs.

Typical attack path

  1. Obtain local access on Linux system
  2. Issue ETHTOOL_GSSET_INFO to learn stat count
  3. Trigger device reconfiguration to change stat count
  4. Issue ETHTOOL_GSTRINGS and ETHTOOL_GSTATS with stale size
  5. Attempt to overflow userspace buffer via mismatched copy

How to detect it

Review kernel logs for ethtool-related buffer issues or oops around stat queries; examine audit logs for frequent ethtool ioctl sequences by non-admin users.

What your security team should do

  • Apply the referenced kernel commit immediately on all affected distributions
  • Prioritize systems exposing ethtool to untrusted local users
  • Monitor for future ethtool-related CVEs in dynamic-counter drivers

The record

In the Linux kernel, the following vulnerability has been resolved: ethtool: Avoid overflowing userspace buffer on stats query The ethtool -S command operates across three ioctl calls: ETHTOOL_GSSET_INFO for the size, ETHTOOL_GSTRINGS for the names, and ETHTOOL_GSTATS for the values. If the number of stats changes between these calls (e.g., due to device reconfiguration), userspace's buffer allocation will be incorrect, potentially leading to buffer overflow. Drivers are generally expected to maintain stable stat counts, but some drivers (e.g., mlx5, bnx2x, bna, ksz884x) use dynamic counters, making this scenario possible. Some drivers try to handle this internally: - bnad_get_ethtool_stats() returns early in case stats.n_stats is not equal to the driver's stats count. - micrel/ksz884x also makes sure not to write anything beyond stats.n_stats and overflow the buffer. However, both use stats.n_stats which is already assigned with the value returned from get_sset_count(), hence won't solve the issue described here. Change ethtool_get_strings(), ethtool_get_stats(), ethtool_get_phy_stats() to not return anything in case of a mismatch between userspace's size and get_sset_size(), to prevent buffer overflow. The returned n_stats value will be equal to zero, to reflect that nothing has been returned. This could result in one of two cases when using upstream ethtool, depending on when the size change is detected: 1. When detected in ethtool_get_strings(): # ethtool -S eth2 no stats available 2. When detected in get stats, all stats will be reported as zero. Both cases are presumably transient, and a subsequent ethtool call should succeed. Other than the overflow avoidance, these two cases are very evident (no output/cleared stats), which is arguably better than presenting incorrect/shifted stats. I also considered returning an error instead of a "silent" response, but that seems more destructive towards userspace apps. Notes: - This patch does not claim to fix the inherent race, it only makes sure that we do not overflow the userspace buffer, and makes for a more predictable behavior. - RTNL lock is held during each ioctl, the race window exists between the separate ioctl calls when the lock is released. - Userspace ethtool always fills stats.n_stats, but it is likely that these stats ioctls are implemented in other userspace applications which might not fill it. The added code checks that it's not zero, to prevent any regressions.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 2.6.12 5.10.248
Mageia:9 kernel 0 6.6.120-1.mga9
Mageia:9 kernel-linus 0 6.6.120-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.14-14.mga9
Mageia:9 kmod-xtables-addons 0 3.24-88.mga9
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.26.1.160000.2.7
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.26.1

Related vulnerabilities