External risk intelligence

Linux Kernel qmi_wwan MAC Header Offset Initialization Failure Causes Kernel Panics.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-68192

This vulnerability is located deep within the Linux kernel networking stack, specifically concerning the handling of MAC header offsets in the qmi_wwan driver. It requires complex, internal kernel-level execution and specific conditions related to local IPsec traffic processing. It is not an internet-facing service or application endpoint reachable by remote attackers.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel could cause system instability or crashes, particularly on ARM64 devices using IPsec over specific network interfaces. The issue stems from an uninitialized offset in how raw IP packets are handled, which can lead to kernel panics when certain network security subsystems attempt to access it.

A kernel issue may cause system crashes.
Leaders should remember kernel stability impacts operations.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could trigger a kernel panic by sending specially crafted network packets. This vulnerability exists in the Linux kernel's handling of network traffic, specifically within the qmi_wwan driver, when processing raw IP packets without proper MAC header initialization. If IPsec is used over the `qmimux0` interface, an uninitialized offset can lead to strict alignment checks failing, causing a system crash.

Network access required.
Uninitialized MAC header offset triggers kernel panic.
Risk of system instability or crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could lead to kernel panics, disrupting system operations. This occurs when raw IP packets are processed without proper initialization of the MAC header offset, particularly when IPsec is in use on specific network interfaces.

System stability.
Uninitialized header access.
Service disruption or crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's networking component, specifically impacting ARM64 systems running IPsec over the qmimux0 interface. Responsibility for addressing this likely falls to infrastructure or platform teams managing the kernel and associated network services. The immediate priority is to identify all instances of the affected Linux kernel, determine their exposure and criticality, and then establish ownership for remediation planning.

Kernel and infrastructure teams own remediation.
Verify kernel reachability and business criticality.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel qmi_wwan driver?

The qmi_wwan driver is a component of the Linux kernel used to manage mobile broadband modems that utilize the Qualcomm MSM Interface (QMI) protocol. It enables connectivity for devices, such as cellular modules, by handling the exchange of data packets between the modem and the operating system's networking stack.

What is the flaw identified in CVE-2025-68192?

This CVE involves an uninitialized pointer issue where the system fails to set a specific offset for MAC headers when processing raw IP packets. Because these packets lack a standard MAC header, the system may crash if other kernel subsystems, like IPsec, attempt to access that undefined memory location to perform strict alignment checks.

How can a system be triggered to crash?

The crash occurs when the kernel attempts to process network traffic via the qmimux0 interface while IPsec is active. The vulnerability is not triggered by standard, non-IPsec traffic, nor does it require external network input to fail; rather, it is a localized memory handling error that manifests specifically during the internal kernel processing of these protected data packets.

Is my infrastructure at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely. This is because the flaw exists deep within the kernel networking stack rather than in an internet-facing service or application. It is not an endpoint that can be remotely accessed, as it requires specific, complex internal kernel-level execution and local IPsec traffic conditions to manifest.

How should I respond to this kernel issue?

First, identify which of your Linux-based systems utilize the qmi_wwan driver and are running IPsec, specifically on ARM64 architectures. Consult with your platform or infrastructure teams to verify your kernel versions. Once affected systems are identified, plan to apply relevant kernel updates or patches during your next scheduled maintenance window to ensure stability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.