{"id":"CVE-2025-68742","revision":"d202edd7911846b39c1d84363bbcb49a","records":[{"revision":"d202edd7911846b39c1d84363bbcb49a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-68742","aliases":[],"title":"bpf: Fix invalid prog->stats access when update_effective_progs fails","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix invalid prog->stats access when update_effective_progs fails\n\nSyzkaller triggers an invalid memory access issue following fault\ninjection in update_effective_progs. The issue can be described as\nfollows:\n\n__cgroup_bpf_detach\n  update_effective_progs\n    compute_effective_progs\n      bpf_prog_array_alloc <-- fault inject\n  purge_effective_progs\n    /* change to dummy_bpf_prog */\n    array->items[index] = &dummy_bpf_prog.prog\n\n---softirq start---\n__do_softirq\n  ...\n    __cgroup_bpf_run_filter_skb\n      __bpf_prog_run_save_cb\n        bpf_prog_run\n          stats = this_cpu_ptr(prog->stats)\n          /* invalid memory access */\n          flags = u64_stats_update_begin_irqsave(&stats->syncp)\n---softirq end---\n\n  static_branch_dec(&cgroup_bpf_enabled_key[atype])\n\nThe reason is that fault injection caused update_effective_progs to fail\nand then changed the original prog into dummy_bpf_prog.prog in\npurge_effective_progs. Then a softirq came, and accessing the members of\ndummy_bpf_prog.prog in the softirq triggers invalid mem access.\n\nTo fix it, skip updating stats when stats is NULL.","state":0,"publishedAt":"2025-12-24T12:09:39.341+00:00","modifiedAt":"2026-10-15T01:10:02.989+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/filter.h\",\n                        \"kernel/bpf/syscall.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"492ecee892c2a4ba6a14903d5d586ff750b7e805\",\n                            \"lessThan\": \"93d1964773ff513c9bd530f7686d3e48b786fa6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"492ecee892c2a4ba6a14903d5d586ff750b7e805\",\n                            \"lessThan\": \"bf2c990b012100610c0f1ec5c4ea434da2d080c2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"492ecee892c2a4ba6a14903d5d586ff750b7e805\",\n                            \"lessThan\": \"539137e3038ce6f953efd72110110f03c14c7d97\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"492ecee892c2a4ba6a14903d5d586ff750b7e805\",\n                            \"lessThan\": \"56905bb70c8b88421709bb4e32fcba617aa37d41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"492ecee892c2a4ba6a14903d5d586ff750b7e805\",\n                            \"lessThan\": \"2579c356ccd35d06238b176e4b460978186d804b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"492ecee892c2a4ba6a14903d5d586ff750b7e805\",\n                            \"lessThan\": \"7dc211c1159d991db609bdf4b0fb9033c04adcbc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/filter.h\",\n                        \"kernel/bpf/syscall.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.160\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.120\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.63\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.17.13\",\n                            \"lessThanOrEqual\": \"6.17.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.2\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/93d1964773ff513c9bd530f7686d3e48b786fa6b","https://git.kernel.org/stable/c/bf2c990b012100610c0f1ec5c4ea434da2d080c2","https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97","https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41","https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b","https://git.kernel.org/stable/c/7dc211c1159d991db609bdf4b0fb9033c04adcbc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-68742","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-68742","identifiers":["CVE-2025-68742"]},"retained":false,"historicalAffected":[]}],"coverage":[]}