CVE-2025-68355: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-68355 is a memory leak vulnerability in the Linux kernel's eBPF (Extended Berkeley Packet Filter) subsystem, specifically in the BPF map management code. The flaw occurs when excl_prog_hash is 0 and excl_prog_hash_size is non-zero, causing the exclusive map memory to not be freed properly. It was published on December 24, 2025, and affects Linux kernel versions prior to the fix commits (between baefdbdf6812 and f0022551745d / 688b745401ab). The vulnerability carries an estimated CVSS severity of Medium, with an EPSS score of approximately 0.018% (Red Hat CVE, Feedly).

The root cause is a missing memory deallocation path in the BPF syscall's map_create function (kernel/bpf/syscall.c), classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When a BPF map is created with a non-zero excl_prog_hash_size but the excl_prog_hash pointer ends up as 0 (NULL), the code path that frees the map is not reached, resulting in a kernel memory leak. The issue was originally identified by syzbot, which reported a BUG: memory leak traceback pointing to map_create+0x322/0x11e0 in kernel/bpf/syscall.c:1512 and __sys_bpf+0x3556/0x3610 at line 6131. Patches are available as kernel commits f0022551745d and 688b745401ab in the stable tree (Red Hat CVE).

Successful exploitation of this vulnerability causes gradual kernel memory exhaustion on affected Linux systems that use eBPF functionality. Over time, unreleased BPF map memory accumulates, leading to degraded system performance, reduced available memory for other processes, and potentially system instability or crashes. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise — but persistent triggering could render a system unresponsive (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: memory leak with backtrace referencing map_create in kernel/bpf/syscall.c or __sys_bpf.
• System Behavior: Gradual, unexplained decrease in available kernel memory (/proc/meminfo showing declining MemFree/MemAvailable) on systems with active eBPF usage.
• Process: Repeated BPF map creation calls (bpf() syscall with BPF_MAP_CREATE command) from processes that do not correspondingly free maps, observable via strace or eBPF tracing tools like bpftool.

The Linux kernel maintainers have released patches addressing this issue in kernel versions 6.18.2 and 6.19-rc1, corresponding to commits f0022551745d72fc0e7bc8601234d690dee2178d and 688b745401ab16e2e1a3b504863f0a45fd345638 in the stable tree. Users should update to a patched kernel version as the primary remediation. As a temporary workaround where patching is not immediately possible, administrators can limit or restrict eBPF map creation by unprivileged users (e.g., via kernel.unprivileged_bpf_disabled=1 sysctl) and monitor system memory usage for anomalies (Red Hat CVE, Feedly).