CVE-2025-68742

Vulnerability

Analysis

CVE-2025-68742 is a BPF subsystem flaw in the Linux kernel, discovered via syzkaller fuzzing with fault injection. The root cause lies in the __cgroup_bpf_detach function. When update_effective_progs fails due to an injected memory allocation fault in bpf_prog_array_alloc, the error handling in purge_effective_progs replaces the original program pointer with dummy_bpf_prog.prog. This dummy program has a NULL stats pointer. A subsequent softirq (e.g., triggered by a network packet) running __cgroup_bpf_run_filter_skb attempts to access prog->stats, causing an invalid memory access and potential kernel crash [1].

Exploitation

An attacker with the ability to trigger capability (such as attaching and detaching BPF programs in cgroups) could combine the detach operation with a fault injection technique (e.g., via a privileged mechanism like fail_function) to reach this race condition. The vulnerability is not directly exploitable without local access to the kernel and some control over BPF program lifecycle. The race window between the detach path setting the dummy program and the softirq execution is necessary for the invalid access to occur [1].

Impact

Successful exploitation leads to a denial-of-service (DoS) condition via an invalid memory access, causing a kernel oops or panic. The CVSS v3.1 score is 5.5 (Medium), indicating local low-complexity exploitation with high availability impact [1], [2], [3].

Mitigation

The fix is merged into the stable kernel trees. It adds a NULL check for prog->stats before accessing it in the stats update path, preventing the use-after-free. Administrators should apply the latest kernel patches (commits referenced below) to their distributions [1], [2], [3].