CVE-2025-68742

bpf: Fix invalid prog->stats access when update_effective_progs fails

Published Dec 24, 2025 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix invalid prog->stats access when update_effective_progs fails

Syzkaller triggers an invalid memory access issue following fault
injection in update_effective_progs. The issue can be described as
follows:

__cgroup_bpf_detach
update_effective_progs
compute_effective_progs
bpf_prog_array_alloc <-- fault inject
purge_effective_progs
/* change to dummy_bpf_prog */
array->items[index] = &dummy_bpf_prog.prog

---softirq start---
__do_softirq
...
__cgroup_bpf_run_filter_skb
__bpf_prog_run_save_cb
bpf_prog_run
stats = this_cpu_ptr(prog->stats)
/* invalid memory access */
flags = u64_stats_update_begin_irqsave(&stats->syncp)
---softirq end---

static_branch_dec(&cgroup_bpf_enabled_key[atype])

The reason is that fault injection caused update_effective_progs to fail
and then changed the original prog into dummy_bpf_prog.prog in
purge_effective_progs. Then a softirq came, and accessing the members of
dummy_bpf_prog.prog in the softirq triggers invalid mem access.

To fix it, skip updating stats when stats is NULL.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`492ecee892c2a4ba6a14903d5d586ff750b7e805`	affected	< 93d1964773ff513c9bd530f7686d3e48b786fa6b
`492ecee892c2a4ba6a14903d5d586ff750b7e805`	affected	< bf2c990b012100610c0f1ec5c4ea434da2d080c2
`492ecee892c2a4ba6a14903d5d586ff750b7e805`	affected	< 539137e3038ce6f953efd72110110f03c14c7d97
`492ecee892c2a4ba6a14903d5d586ff750b7e805`	affected	< 56905bb70c8b88421709bb4e32fcba617aa37d41
`492ecee892c2a4ba6a14903d5d586ff750b7e805`	affected	< 2579c356ccd35d06238b176e4b460978186d804b
`492ecee892c2a4ba6a14903d5d586ff750b7e805`	affected	< 7dc211c1159d991db609bdf4b0fb9033c04adcbc

Linux

affected

Version	Status	Constraints
`5.1`	affected	—
`0`	unaffected	< 5.1
`6.1.160`	unaffected	≤ 6.1.*
`6.6.120`	unaffected	≤ 6.6.*
`6.12.63`	unaffected	≤ 6.12.*
`6.17.13`	unaffected	≤ 6.17.*
`6.18.2`	unaffected	≤ 6.18.*
`6.19`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4476-1	linux-6.1 security update
Debian DSA	DSA-6127-1	linux security update
Ubuntu USN	USN-8094-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8094-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8094-3	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8094-4	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8094-5	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8152-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8179-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8184-1	Linux kernel (Real-time) vulnerabilities
Ubuntu USN	USN-8179-2	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8185-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8179-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8203-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8204-1	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8185-2	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-8179-4	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8258-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8260-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8261-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8265-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8440-1	Linux kernel (Azure) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.212% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b
https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97
https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41
https://git.kernel.org/stable/c/7dc211c1159d991db609bdf4b0fb9033c04adcbc
https://git.kernel.org/stable/c/93d1964773ff513c9bd530f7686d3e48b786fa6b
https://git.kernel.org/stable/c/bf2c990b012100610c0f1ec5c4ea434da2d080c2
https://lore.kernel.org/linux-cve-announce/2025122415-CVE-2025-68742-367d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-68742
https://www.cve.org/CVERecord?id=CVE-2025-68742

History

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Jan 11, 2026 4:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/93d1964773ff513c9bd530f7686d3e48b786fa6b https://git.kernel.org/stable/c/bf2c990b012100610c0f1ec5c4ea434da2d080c2

Dec 25, 2025 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025122415-CVE-2025-68742-367d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-68742 https://www.cve.org/CVERecord?id=CVE-2025-68742
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Dec 24, 2025 12:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be described as follows: __cgroup_bpf_detach update_effective_progs compute_effective_progs bpf_prog_array_alloc <-- fault inject purge_effective_progs /* change to dummy_bpf_prog / array->items[index] = &dummy_bpf_prog.prog ---softirq start--- __do_softirq ... __cgroup_bpf_run_filter_skb __bpf_prog_run_save_cb bpf_prog_run stats = this_cpu_ptr(prog->stats) / invalid memory access */ flags = u64_stats_update_begin_irqsave(&stats->syncp) ---softirq end--- static_branch_dec(&cgroup_bpf_enabled_key[atype]) The reason is that fault injection caused update_effective_progs to fail and then changed the original prog into dummy_bpf_prog.prog in purge_effective_progs. Then a softirq came, and accessing the members of dummy_bpf_prog.prog in the softirq triggers invalid mem access. To fix it, skip updating stats when stats is NULL.
Title		bpf: Fix invalid prog->stats access when update_effective_progs fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97 https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41 https://git.kernel.org/stable/c/7dc211c1159d991db609bdf4b0fb9033c04adcbc