CVE-2025-68742: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68742 is an invalid memory access vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the cgroup BPF program management path. It was published on December 24, 2025, and affects Linux kernel versions from 5.1 onward, with patches available in stable branches 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1. Microsoft's Azure Linux (azl3) kernel versions 6.6.117.1-1 and 6.6.119.3-3 are among the confirmed affected products. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is a NULL pointer dereference / invalid memory access (CWE-476) in the Linux kernel's bpf_prog_run function, triggered by a race condition between a failed update_effective_progs operation and a subsequent softirq handler. When bpf_prog_array_alloc fails during compute_effective_progs (e.g., via fault injection or memory pressure), purge_effective_progs substitutes the original BPF program with dummy_bpf_prog. If a softirq fires before cleanup completes and calls bpf_prog_run, it attempts to dereference prog->stats via this_cpu_ptr(prog->stats) on the dummy program, which has a NULL stats pointer, causing an invalid memory access. The fix skips the stats update when stats is NULL (Feedly). The attack vector is local and requires low privileges (PR:L), making it accessible to any unprivileged user with local system access on systems where cgroup BPF is in use.

Successful exploitation causes a kernel crash, resulting in a denial of service (DoS) affecting the entire system. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running cgroup BPF programs (common in containerized environments, Kubernetes nodes, and cloud infrastructure) are particularly at risk, as a crash could disrupt all workloads on the affected host (Feedly, Microsoft MSRC).

Apply the latest kernel security updates from your Linux distribution. Patched Linux kernel stable versions include 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1 or later. For Microsoft Azure Linux (azl3), update to the patched versions of kernel 6.6.117.1-1 or 6.6.119.3-3. Debian has released fixes in linux 6.1.162-1 (oldstable/security and LTS). Ubuntu has issued advisories USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, and USN-8265-1. As a temporary workaround where immediate patching is not possible, consider restricting unprivileged BPF operations via sysctl kernel.unprivileged_bpf_disabled=1 (Microsoft MSRC, Feedly).