Low

Out-of-bounds access in Linux kernel BPF verifier widen_imprecise_scalars()

IdentifiersCVE-2025-68208CWE-125

CVE-2025-68208 is a Linux kernel BPF verifier vulnerability in widen_imprecise_scalars(). The bug arises because the function is invoked with a previously explored ancestor verifier state (prev_st) and a newly queued verifier state (queued_st), and those states are not guaranteed to have the same allocated stack depth. In some control-flow patterns, such as repeated calls through the same callsite with different parameters causing different stack usage, prev_st->allocated_stack can be larger than queued_st->allocated_stack. If widen_imprecise_scalars() does not account for the current allocated stack depth, it can access bpf_verifier_state->frame[*]->stack outside the bounds of the currently allocated stack for the queued state. The upstream fix explicitly accounts for the current allocated stack depth to prevent this out-of-bounds stack access during verifier state processing.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause out-of-bounds access in kernel memory during BPF verifier processing. Based on the provided scoring and vendor context, the primary impacts are high confidentiality and high availability: an attacker with sufficient local privileges may be able to trigger kernel memory disclosure and potentially crash or destabilize the system during BPF program verification. The provided content does not establish reliable evidence of code execution; the verified impact is kernel memory safety violation leading to information exposure and denial of service.

Mitigation

If you can’t patch tonight, do this now.

Until patched kernels can be deployed, reduce exposure by restricting untrusted local users from loading or exercising BPF functionality, and disable or tightly control unprivileged BPF use where supported by policy and kernel configuration. Because the issue is local and requires high privileges according to the provided scoring, limiting access to privileged local accounts and minimizing BPF availability reduces exploitability. Mitigation details beyond access restriction and prompt patching are not specifically provided in the source content.

Remediation

Patch, then assume compromise.

Apply a Linux kernel update that includes the upstream BPF fix for CVE-2025-68208, specifically the change to account for current allocated stack depth in widen_imprecise_scalars(). For SUSE environments, install the vendor-provided fixed kernel packages for the affected product branch, such as kernel-default >= 6.4.0-150700.53.28.1 for SLES 15 SP7 or kernel-default >= 6.12.0-160000.9.1 for SLES 16.0/openSUSE Leap 16.0/SLE Micro 6.2, as applicable. Reboot after installing the updated kernel.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

11 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3