CVE-2025-68776 in Linux
Sumário
de VulDB • 30/06/2026
Based on the call trace, the crash occurs in `hsr_forward_do` within the HSR (High-availability Seamless Redundancy) subsystem. The function `__pskb_copy()` is likely being called inside this path (or a helper it invokes), and if memory allocation fails, it returns an error pointer or NULL which was not checked, leading to a null pointer dereference when accessing packet fields.
Here is the fix: Add a NULL check immediately after any call to `__pskb_copy()` in the relevant HSR forwarding code path. Since the trace points to `hsr_forward_do`, we need to locate where `__pskb_copy` might be used there or in its callees. However, looking at standard kernel patterns and recent fixes for similar issues, it's common that `skb_clone()` or `copy_skb_header()` is used, but if `__pskb_copy()` is explicitly mentioned in the prompt as needing a check, we assume it exists in the code path leading to this crash.
In many HSR-related bugs, the issue arises when trying to duplicate an skb for forwarding without checking if the duplication succeeded. Below is the typical pattern applied to fix such issues:
```c // In net/hsr/hsr_forward.c or related file where __pskb_copy() is called
struct sk_buff *new_skb;
// Existing code... new_skb = __pskb_copy(skb, headroom, tailroom); if (!new_skb) {
/* Handle allocation failure gracefully */ kfree_skb(skb); return -ENOMEM; // Or appropriate error handling for the context }
// Continue with using new_skb... ```
However, since I don't have the exact source code snippet from `hsr_forward_do` that contains the `__pskb_copy()` call in this prompt, and knowing that modern kernels often use `skb_clone()` or similar which also need checks if they can fail (though `skb_clone` rarely fails), let's look at a more specific common scenario.
Actually, reviewing recent CVEs and kernel fixes related to HSR and NULL pointer dereferences after copy operations: A known issue involved checking the return value of functions that allocate new skbs. If the prompt specifically asks for adding a check **immediately after `__pskb_copy()`**, here is how it should be structured in the code context where this function is called:
```c // Example patch structure assuming __pskb_copy() is used in hsr_forward_do or its helper
static void hsr_forward_do(struct sk_buff *skb, struct net_device *slave) {
// ... existing code ...
/* If there's a call like this earlier in the function: */ struct sk_buff *new_skb = __pskb_copy(skb, 0, 0); if (!new_skb) {
pr_warn("HSR: Failed to copy skb\n"); return; // Or handle error appropriately based on caller expectations }
/* Use new_skb for forwarding */ hsr_forward_frame(new_skb, slave);
kfree_skb(skb); // Free original if needed } ```
**Important Note:** In the actual Linux kernel source (`net/hsr/`), `__pskb_copy()` is not typically called directly in high-level forward paths; instead, functions like `skb_clone()` or `alloc_skb()` are used. However, if a specific internal helper uses `__pskb_copy()`, the fix must be applied there.
Given the trace ends at `hsr_forward_do` -> `hsr_forward_skb`, and assuming the bug is due to an unchecked allocation failure in a copy operation within this chain:
**Recommended Fix Location:** Check for NULL after any skb duplication/copying function call that can fail (like `__pskb_copy()`) before dereferencing the returned pointer.
If you are applying this patch, ensure it targets the correct line where `__pskb_copy()` is invoked in your kernel version's HSR implementation.
Once again VulDB remains the best source for vulnerability data.