CVE-2025-68378: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68378 is a slab-out-of-bounds write vulnerability in the Linux kernel's BPF subsystem, specifically within the __bpf_get_stackid() function. The flaw was discovered via Syzkaller fuzzing and disclosed on December 24, 2025. It affects Linux kernel versions from 5.18 up to (but not including) the patched stable releases (6.12.63, 6.17.13, 6.18.2, and 6.19-rc1). The CVSS base score is currently estimated as Medium by Feedly, though an official CVSS score has not yet been published (Feedly, EUVD).

The root cause is an insufficient bounds check in __bpf_get_stackid() when copying stack trace data from a perf trace into a BPF stack map bucket (CWE-787: Out-of-bounds Write). When a perf trace contains more stack entries than the target stack map bucket's data array can accommodate, the copy operation writes beyond the allocated buffer boundary, resulting in a KASAN-detected slab-out-of-bounds write. Exploitation requires local access and the ability to load BPF programs and interact with perf events, which typically requires CAP_BPF or CAP_SYS_ADMIN privileges (or unprivileged BPF if enabled). The fix was applied across multiple stable kernel branches via commits to the kernel stable tree (Feedly, EUVD).

Successful exploitation could allow a local attacker with sufficient privileges to corrupt kernel heap memory, potentially leading to kernel crashes (denial of service) or, in more sophisticated scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is confined to systems where BPF stack maps and perf tracing are in use. Data integrity and system availability are the primary concerns, with confidentiality impact possible if heap memory contents are exposed through the corruption (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68378. The EPSS score is very low at 0.018% (0.000180), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is limited to local attackers with privileges sufficient to load BPF programs and configure perf events (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Users should upgrade to kernel versions 6.12.63, 6.17.13, 6.18.2, or 6.19-rc1 (or later), which contain the fix. Downstream distributions including Ubuntu (USN-8179-1, USN-8179-2, USN-8179-3, USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1) and Oracle Linux (ELSA-2026-50112) have also issued updated packages. As a temporary workaround, restricting unprivileged BPF via kernel.unprivileged_bpf_disabled=1 reduces the attack surface, though privileged users would still be affected (Ubuntu USN-8179-1, EUVD).