CVE-2025-68742 (GCVE-0-2025-68742)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:09 – Updated: 2026-05-11 21:52
VLAI
Title
bpf: Fix invalid prog->stats access when update_effective_progs fails
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog */ array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) /* invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 492ecee892c2a4ba6a14903d5d586ff750b7e805 , < 93d1964773ff513c9bd530f7686d3e48b786fa6b (git)
Affected: 492ecee892c2a4ba6a14903d5d586ff750b7e805 , < bf2c990b012100610c0f1ec5c4ea434da2d080c2 (git)
Affected: 492ecee892c2a4ba6a14903d5d586ff750b7e805 , < 539137e3038ce6f953efd72110110f03c14c7d97 (git)
Affected: 492ecee892c2a4ba6a14903d5d586ff750b7e805 , < 56905bb70c8b88421709bb4e32fcba617aa37d41 (git)
Affected: 492ecee892c2a4ba6a14903d5d586ff750b7e805 , < 2579c356ccd35d06238b176e4b460978186d804b (git)
Affected: 492ecee892c2a4ba6a14903d5d586ff750b7e805 , < 7dc211c1159d991db609bdf4b0fb9033c04adcbc (git)
Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.63 , ≤ 6.12.* (semver)
Unaffected: 6.17.13 , ≤ 6.17.* (semver)
Unaffected: 6.18.2 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/filter.h",
            "kernel/bpf/syscall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "93d1964773ff513c9bd530f7686d3e48b786fa6b",
              "status": "affected",
              "version": "492ecee892c2a4ba6a14903d5d586ff750b7e805",
              "versionType": "git"
            },
            {
              "lessThan": "bf2c990b012100610c0f1ec5c4ea434da2d080c2",
              "status": "affected",
              "version": "492ecee892c2a4ba6a14903d5d586ff750b7e805",
              "versionType": "git"
            },
            {
              "lessThan": "539137e3038ce6f953efd72110110f03c14c7d97",
              "status": "affected",
              "version": "492ecee892c2a4ba6a14903d5d586ff750b7e805",
              "versionType": "git"
            },
            {
              "lessThan": "56905bb70c8b88421709bb4e32fcba617aa37d41",
              "status": "affected",
              "version": "492ecee892c2a4ba6a14903d5d586ff750b7e805",
              "versionType": "git"
            },
            {
              "lessThan": "2579c356ccd35d06238b176e4b460978186d804b",
              "status": "affected",
              "version": "492ecee892c2a4ba6a14903d5d586ff750b7e805",
              "versionType": "git"
            },
            {
              "lessThan": "7dc211c1159d991db609bdf4b0fb9033c04adcbc",
              "status": "affected",
              "version": "492ecee892c2a4ba6a14903d5d586ff750b7e805",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/filter.h",
            "kernel/bpf/syscall.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.63",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.13",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.2",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix invalid prog-\u003estats access when update_effective_progs fails\n\nSyzkaller triggers an invalid memory access issue following fault\ninjection in update_effective_progs. The issue can be described as\nfollows:\n\n__cgroup_bpf_detach\n  update_effective_progs\n    compute_effective_progs\n      bpf_prog_array_alloc \u003c-- fault inject\n  purge_effective_progs\n    /* change to dummy_bpf_prog */\n    array-\u003eitems[index] = \u0026dummy_bpf_prog.prog\n\n---softirq start---\n__do_softirq\n  ...\n    __cgroup_bpf_run_filter_skb\n      __bpf_prog_run_save_cb\n        bpf_prog_run\n          stats = this_cpu_ptr(prog-\u003estats)\n          /* invalid memory access */\n          flags = u64_stats_update_begin_irqsave(\u0026stats-\u003esyncp)\n---softirq end---\n\n  static_branch_dec(\u0026cgroup_bpf_enabled_key[atype])\n\nThe reason is that fault injection caused update_effective_progs to fail\nand then changed the original prog into dummy_bpf_prog.prog in\npurge_effective_progs. Then a softirq came, and accessing the members of\ndummy_bpf_prog.prog in the softirq triggers invalid mem access.\n\nTo fix it, skip updating stats when stats is NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:52:28.112Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/93d1964773ff513c9bd530f7686d3e48b786fa6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf2c990b012100610c0f1ec5c4ea434da2d080c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97"
        },
        {
          "url": "https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41"
        },
        {
          "url": "https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dc211c1159d991db609bdf4b0fb9033c04adcbc"
        }
      ],
      "title": "bpf: Fix invalid prog-\u003estats access when update_effective_progs fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68742",
    "datePublished": "2025-12-24T12:09:39.341Z",
    "dateReserved": "2025-12-24T10:30:51.030Z",
    "dateUpdated": "2026-05-11T21:52:28.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68742",
      "date": "2026-05-27",
      "epss": "0.00027",
      "percentile": "0.08136"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68742\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:29.147\",\"lastModified\":\"2026-01-11T17:15:57.683\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix invalid prog-\u003estats access when update_effective_progs fails\\n\\nSyzkaller triggers an invalid memory access issue following fault\\ninjection in update_effective_progs. The issue can be described as\\nfollows:\\n\\n__cgroup_bpf_detach\\n  update_effective_progs\\n    compute_effective_progs\\n      bpf_prog_array_alloc \u003c-- fault inject\\n  purge_effective_progs\\n    /* change to dummy_bpf_prog */\\n    array-\u003eitems[index] = \u0026dummy_bpf_prog.prog\\n\\n---softirq start---\\n__do_softirq\\n  ...\\n    __cgroup_bpf_run_filter_skb\\n      __bpf_prog_run_save_cb\\n        bpf_prog_run\\n          stats = this_cpu_ptr(prog-\u003estats)\\n          /* invalid memory access */\\n          flags = u64_stats_update_begin_irqsave(\u0026stats-\u003esyncp)\\n---softirq end---\\n\\n  static_branch_dec(\u0026cgroup_bpf_enabled_key[atype])\\n\\nThe reason is that fault injection caused update_effective_progs to fail\\nand then changed the original prog into dummy_bpf_prog.prog in\\npurge_effective_progs. Then a softirq came, and accessing the members of\\ndummy_bpf_prog.prog in the softirq triggers invalid mem access.\\n\\nTo fix it, skip updating stats when stats is NULL.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7dc211c1159d991db609bdf4b0fb9033c04adcbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/93d1964773ff513c9bd530f7686d3e48b786fa6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf2c990b012100610c0f1ec5c4ea434da2d080c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.