In the Linux kernel, the following vulnerability has been resolved: caif: fix integer underflow in cffrml_receive() The cffrml_receive() function extracts a length field from the packet header and, when FCS is disabled, subtracts 2 from this length without validating that len >= 2. If an attacker sends a malicious packet with a length field of 0 or 1 to an interface with FCS disabled, the subtraction causes an integer underflow. This can lead to memory exhaustion and kernel instability, potential information disclosure if padding contains uninitialized kernel memory. Fix this by validating that len >= 2 before performing the subtraction.
Conclusion & alert: CVE-2025-68799 is rated Low Risk (7/100): low exploitation likelihood (EPSS 0.17%). Mandatory action: Low composite risk—no urgent action required; patch on your normal maintenance cycle and revisit priority if CVSS or EPSS increases.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.04% | 0.17% | +0.13% |
| 2 | 2026-06-11 | 0.06% | 0.04% | -0.01% |
| 3 | 2026-02-10 | — | 0.06% | — |
Full EPSS history (4 records total)
CVSS metrics for this CVE.
No CVSS data in dataset for this CVE.
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2025-68799 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. | https://security-tracker.debian.org/tracker/CVE-2025-68799 |
redhat
|
— | — | https://access.redhat.com/security/cve/CVE-2025-68799 |
suse
|
medium | CVE-2025-68799 severity moderate: SUSE including 104 source package names (13.2-9.1:libsqlite3-0-3.49.1-1.1, 2.1.3-6.31:libsqlite3-0-3.49.1-1.1, …), 264 product×package rows across 42 product lines (Container suse/sl-micro/6.0/baremetal-os-container, Container suse/sl-micro/6.0/base-os-container, … (42 product lines)): Fixed 165, Known Not Affected 74, First Fixed 25. | https://www.suse.com/security/cve/CVE-2025-68799/ |
ubuntu
|
medium | CVE-2025-68799 medium priority: Ubuntu including 157 source packages (linux, linux-allwinner-5.19, …), 1562 status rows across 10 suites (bionic, focal, jammy, noble, plucky, questing, resolute, trusty, upstream, xenial): DNE 1157, ignored 183, released 150, needed 49, pending 12, not-affected 11. | https://ubuntu.com/security/CVE-2025-68799 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||