---
id: CVE-2025-68234
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/cmd_net: fix wrong argument types for skb_queue_splice()

  If timestamp retriving needs to be retried and the local list of
  SKB's already has entries, then it's…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/cmd_net: fix wrong argument types for skb_queue_splice()

  If timestamp retriving needs to be retried and the local list of
  SKB's already has entries, then it's…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2025-12-16'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68234'
references:
  - url: 'https://git.kernel.org/stable/c/46447367a52965e9d35f112f5b26fc8ff8ec443d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c85d2cfc5e24e6866b56c7253fd4e1c7db35986c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00133
epssPercentile: 0.02494
ingestedAt: '2026-10-14T13:30:58.462Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/cmd_net: fix wrong argument types for skb_queue_splice()

If timestamp retriving needs to be retried and the local list of
SKB's already has entries, then it's spliced back into the socket
queue. However, the arguments for the splice helper are transposed,
causing exactly the wrong direction of splicing into the on-stack
list. Fix that up.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.