CVE-2025-68799

What it actually does

Integer underflow in cffrml_receive() when FCS is disabled: length field of 0 or 1 is decremented by 2 without a prior bounds check, producing a very large size value that drives excessive memory allocation, kernel instability, or exposure of uninitialized kernel memory via padding.

Why it matters to the business

Affected Linux systems may experience denial-of-service crashes, resource exhaustion, or unintended disclosure of kernel memory; organizations running CAIF-enabled kernels must schedule kernel updates that can require reboots and temporary service disruption.

How an attack unfolds

An attacker sends a malicious CAIF frame containing a length field of 0 or 1 toward an interface configured with FCS disabled; the receive path subtracts 2 from the length, underflows, and triggers uncontrolled allocation or memory-handling errors that can destabilize the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit f407f1c9f45bbf5c99fd80b3f3f4a94fdbe35691 (or any later stable commit that includes the bounds check before the subtraction). Rebuild and reboot affected systems; verify the fix is present via git log or kernel version string.

How to confirm the fix worked

Confirm the presence of the upstream commit or an equivalent back-port in the running kernel; attempt to reproduce the original underflow with a crafted length-0/1 frame on a test interface that has FCS disabled and verify the kernel no longer crashes or leaks memory.

Typical attack path

1. Identify Linux host exposing a CAIF interface with FCS disabled
2. Craft and transmit a network frame with length field set to 0 or 1
3. Trigger integer underflow inside cffrml_receive()
4. Induce memory exhaustion, kernel panic, or information disclosure

How to detect it

Inspect kernel logs (dmesg, /var/log/kern.log, journalctl) for oops, WARN, or allocation failures mentioning caif or cffrml_receive; correlate with network interface statistics showing unexpected small-length frames on CAIF links.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all systems that may use CAIF
• Review kernel configuration to determine whether CAIF is required and disable the module if unused
• Add monitoring for kernel oops or out-of-memory events involving caif or cffrml_receive