CVE-2025-68321

A flaw was found in the Linux kernel. When driver authors fail to include the GFP_NOWARN flag for ATOMIC page allocations within the datapath, it can lead to issues. This omission may cause network receive operations to experience page allocation failures during out-of-memory (OOM) conditions. The primary consequence is a Denial of Service (DoS) for the affected system.

A LOW impact flaw was found in the Linux kernel network page_pool implementation used in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When a network driver performs ATOMIC page allocations on the receive datapath without the GFP_NOWARN flag, network receive (Rx) processing may hit page allocation failures during out-of-memory (OOM) conditions, which can result in a denial of service on the affected system. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. The affected Red Hat Enterprise Linux 7 through 10 kernel and kernel-rt streams and Red Hat In-Vehicle OS 1.1 currently have fixes deferred, as this issue is rated low impact; the residual risk is that network receive processing on affected systems can experience page allocation failures while the system is under sustained memory pressure. Red Hat's severity assessment (impact LOW, CVSS 3.1 score 5.5 with a local attack vector) differs from the upstream CVE.org rating (IMPORTANT, CVSS 3.1 score 7.5 with a network attack vector) because the failure condition depends on the system already being under out-of-memory pressure rather than on remote attacker-controlled input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.