CVE-2025-68216: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68216 is a vulnerability in the Linux kernel affecting the LoongArch architecture's BPF trampoline implementation, where attaching BPF programs to kernel module functions causes severe stability issues including kernel lockups and traffic disruption in critical modules such as WireGuard. The issue was published on December 16, 2025, and affects the Linux kernel on LoongArch platforms. The fix disables BPF trampoline attachments to kernel module functions on LoongArch as a temporary mitigation. No CVSS score has been officially assigned at this time, and the CVE status is listed as Unknown (Feedly, CVE.org).

The root cause is an incompatibility in the LoongArch BPF trampoline implementation when tracing functions located in kernel modules, as opposed to built-in kernel functions. When a BPF program is attached via fentry to a module function, the trampoline code does not correctly handle the module context, leading to kernel lockups and functional disruption of the traced module (e.g., WireGuard traffic stops). The vulnerability is classified under improper handling of kernel module function tracing in the BPF subsystem (CWE classification not formally assigned). The fix, applied via kernel patches, prevents the BPF subsystem from permitting trampoline attachments to kernel module functions on LoongArch until the underlying trampoline code is corrected (Feedly, kernel.org patch 1, kernel.org patch 2).

Exploitation of this vulnerability — even unintentionally through legitimate BPF usage — can result in kernel lockups (complete loss of availability) on LoongArch systems, as well as disruption of critical kernel module functionality such as WireGuard VPN traffic. The bpf_selftests/module_attach test fails consistently, indicating a broad impact on BPF-based observability and tracing tools targeting module functions. The primary impact is on availability; there is no evidence of confidentiality or integrity compromise (Feedly).

There is no evidence of in-the-wild exploitation or public proof-of-concept exploit code for CVE-2025-68216. The vulnerability is triggered by attaching a BPF program to a kernel module function on LoongArch, which requires local access and BPF privileges (typically root or CAP_BPF). The EPSS score is 0.018% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Feedly).

The Linux kernel maintainers have addressed this issue by patching the BPF subsystem to return -ENOTSUPP when a trampoline attachment to a kernel module function is attempted on LoongArch, effectively disabling the feature until a proper fix is developed. Users running LoongArch-based Linux systems should apply the relevant stable kernel patches (referenced at 44eb384 and 677e612 on kernel.org). As a workaround prior to patching, avoid attaching BPF fentry/fexit programs to functions in kernel modules on LoongArch systems (kernel.org patch 1, kernel.org patch 2).