Low

Linux kernel BPF invalid prog->stats access when update_effective_progs fails

IdentifiersCVE-2025-68742CWE-476

CVE-2025-68742 is a Linux kernel vulnerability in the BPF/cgroup program management path. When update_effective_progs() fails during cgroup BPF detach processing, such as after fault injection causing bpf_prog_array_alloc() to fail inside compute_effective_progs(), the cleanup path purge_effective_progs() can replace the original program pointer with dummy_bpf_prog.prog. A subsequent softirq execution path (__cgroup_bpf_run_filter_skb -> __bpf_prog_run_save_cb -> bpf_prog_run) may then attempt to access prog->stats via this_cpu_ptr(prog->stats). Because dummy_bpf_prog.prog does not provide a valid stats pointer in this context, the kernel performs an invalid memory access when updating runtime statistics. The upstream fix changes the logic to skip stats updates when stats is NULL.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful triggering causes invalid kernel memory access in softirq context, primarily resulting in kernel instability or a crash, i.e. denial of service / availability loss. The provided scoring and advisory context indicate no demonstrated confidentiality or integrity impact; the main consequence is local disruption of the affected system.

Mitigation

If you can’t patch tonight, do this now.

No robust workaround is documented in the provided content. Practical mitigation is limited to reducing exposure to the affected cgroup BPF attach/detach path, avoiding fault-injection testing on production systems, restricting high-privilege local access, and applying the vendor-supplied patched kernel as soon as possible.

Remediation

Patch, then assume compromise.

Update to a Linux kernel build that includes the upstream fix for CVE-2025-68742. The fix is to avoid updating BPF program runtime statistics when the stats pointer is NULL in the affected execution path. Vendor advisories indicate fixed packages are available in multiple SUSE and Debian kernel releases; administrators should install the relevant vendor kernel update and reboot the system.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

LinuxLinux Kerneloperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

11 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

11 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3