cbcvebase.
CVE-2025-68742
published 2025-12-24

CVE-2025-68742: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an…

PriorityP422high7.2
EPSS
0.18%
7.7th percentile
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL.

Affected

41 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= 492ecee892c2a4ba6a14903d5d586ff750b7e805 < 93d1964773ff513c9bd530f7686d3e48b786fa6b93d1964773ff513c9bd530f7686d3e48b786fa6b
linuxlinux>= 492ecee892c2a4ba6a14903d5d586ff750b7e805 < bf2c990b012100610c0f1ec5c4ea434da2d080c2bf2c990b012100610c0f1ec5c4ea434da2d080c2
linuxlinux>= 492ecee892c2a4ba6a14903d5d586ff750b7e805 < 539137e3038ce6f953efd72110110f03c14c7d97539137e3038ce6f953efd72110110f03c14c7d97
linuxlinux>= 492ecee892c2a4ba6a14903d5d586ff750b7e805 < 56905bb70c8b88421709bb4e32fcba617aa37d4156905bb70c8b88421709bb4e32fcba617aa37d41
linuxlinux>= 492ecee892c2a4ba6a14903d5d586ff750b7e805 < 2579c356ccd35d06238b176e4b460978186d804b2579c356ccd35d06238b176e4b460978186d804b
linuxlinux>= 492ecee892c2a4ba6a14903d5d586ff750b7e805 < 7dc211c1159d991db609bdf4b0fb9033c04adcbc7dc211c1159d991db609bdf4b0fb9033c04adcbc
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.63-16.12.63-1
linuxlinux_kernel>= 0 < 6.17.13-16.17.13-1
linuxlinux_kernel>= 0 < 6.17.0-19.196.17.0-19.19
linuxlinux_kernel>= 5.1.0 < 6.1.1606.1.160
linuxlinux_kernel>= 6.13.0 < 6.17.136.17.13
linuxlinux_kernel>= 6.18.0 < 6.18.26.18.2
linuxlinux_kernel>= 6.2.0 < 6.6.1206.6.120
linuxlinux_kernel>= 6.7.0 < 6.12.636.12.63
msrcazl3_kernel_6.6.117.1-1_on_azure_linux_3.0
msrcazl3_kernel_6.6.119.3-1_on_azure_linux_3.0
msrcazl3_kernel_6.6.119.3-3_on_azure_linux_3.0
ubuntulinux-aws-fips
ubuntulinux-azure
ubuntulinux-azure-6.8
ubuntulinux-azure-fips

CVSS provenance

osv7.2HIGH
vendor_ubuntu7.2HIGH
vendor_redhat5.8MEDIUM
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.