cbcvebase.
CVE-2025-68339
published 2025-12-23

CVE-2025-68339: In the Linux kernel, the following vulnerability has been resolved: atm/fore200e: Fix possible data race in fore200e_open() Protect access to…

PriorityP422high7.8
EPSS
0.17%
6.3th percentile
In the Linux kernel, the following vulnerability has been resolved: atm/fore200e: Fix possible data race in fore200e_open() Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race. The field fore200e->available_cell_rate is a shared resource used to track available bandwidth. It is concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos(). In fore200e_open(), the lock rate_mtx is correctly held when subtracting vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the function restores the reserved bandwidth by adding back to available_cell_rate without holding the lock. This introduces a race condition because available_cell_rate is a global device resource shared across all VCCs. If the error path in fore200e_open() executes concurrently with operations like fore200e_close() or fore200e_change_qos() on other VCCs, a read-modify-write race occurs. Specifically, the error path reads the rate without the lock. If another CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in fore200e_close()) between this read and the subsequent write, the error path will overwrite the concurrent update with a stale value. This results in incorrect bandwidth accounting.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.159-1 (bookworm)linux 6.1.159-1 (bookworm)
debianlinux-6.1< linux 6.1.159-1 (bookworm)linux 6.1.159-1 (bookworm)
linuxlinux
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1b60f42a639999c37da7f1fbfa1ad29cf4cbdd2d1b60f42a639999c37da7f1fbfa1ad29cf4cbdd2d
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bd1415efbab507b9b995918105eef953013449ddbd1415efbab507b9b995918105eef953013449dd
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ed34c70d88e2b8b9bc6c3ede88751186d6c6d5d1ed34c70d88e2b8b9bc6c3ede88751186d6c6d5d1
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9917ba597cf95f307778e495f71ff25a5064d1679917ba597cf95f307778e495f71ff25a5064d167
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 667ac868823224374f819500adc5baa2889c7bc5667ac868823224374f819500adc5baa2889c7bc5
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6610361458e7eb6502dd3182f586f91fcc2180396610361458e7eb6502dd3182f586f91fcc218039
linuxlinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 82fca3d8a4a34667f01ec2351a607135249c9cff82fca3d8a4a34667f01ec2351a607135249c9cff
linuxlinux_kernel>= 0 < 5.10.247-15.10.247-1
linuxlinux_kernel>= 0 < 6.1.159-16.1.159-1
linuxlinux_kernel>= 0 < 6.12.63-16.12.63-1
linuxlinux_kernel>= 0 < 6.17.11-16.17.11-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 0 < 6.17.0-19.196.17.0-19.19
linuxlinux_kernel>= 2.6.12 < 5.10.2475.10.247
linuxlinux_kernel>= 5.11.0 < 5.15.1975.15.197
linuxlinux_kernel>= 5.16.0 < 6.1.1596.1.159
linuxlinux_kernel>= 6.13.0 < 6.17.116.17.11
linuxlinux_kernel>= 6.2.0 < 6.6.1196.6.119
linuxlinux_kernel>= 6.7.0 < 6.12.616.12.61
msrcazl3_kernel_6.6.117.1-1_on_azure_linux_3.0
ubuntulinux-azure-5.15

CVSS provenance

osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_msrc4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.