cve 2025 68363

CVE-2025-68363 is a kernel-level vulnerability in the Linux BPF helper bpf_skb_check_mtu. The bug occurs when the BPF_MTU_CHK_SEGS flag is used: the helper assumed skb->transport_header was always valid, but that field can be unset in some code paths, leading to WARN messages and potential failures when validating GSO skbs. The issue was patched by adding an explicit check using skb_transport_header_was_set before accessing skb->transport_header, along with new testcases. The CVE was assigned and published by vulnerability databases in late December 2025. This tag covers discussions about the fix, its implications for network packet processing, and related kernel security updates.