CVE-2025-68200

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Add bpf_prog_run_data_pointers()<br /> <br /> syzbot found that cls_bpf_classify() is able to change<br /> tc_skb_cb(skb)-&gt;drop_reason triggering a warning in sk_skb_reason_drop().<br /> <br /> WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]<br /> WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214<br /> <br /> struct tc_skb_cb has been added in commit ec624fe740b4 ("net/sched:<br /> Extend qdisc control block with tc control block"), which added a wrong<br /> interaction with db58ba459202 ("bpf: wire in data and data_end for<br /> cls_act_bpf").<br /> <br /> drop_reason was added later.<br /> <br /> Add bpf_prog_run_data_pointers() helper to save/restore the net_sched<br /> storage colliding with BPF data_meta/data_end.