CVE-2025-68744: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68744 is a memory leak vulnerability in the Linux kernel's eBPF subsystem, specifically affecting the handling of per-CPU hash maps (percpu_hash and lru_percpu_hash). The flaw exists in the pcpu_copy_value() function, which fails to call bpf_obj_free_fields() when updating map entries containing BPF_KPTR_REF or BPF_KPTR_PERCPU special pointer fields, causing referenced memory to be retained until the map is destroyed. It was published on December 24, 2025, with a patch made available by Microsoft on December 25, 2025. Affected Microsoft Azure Linux kernel versions include azl3_kernel_6.6.117.1-1 and azl3_kernel_6.6.119.3-3. The CVSS v3.1 base score is 5.5 (Medium) (Microsoft MSRC).

The root cause is a missing cleanup call in the pcpu_copy_value() function within the Linux kernel's BPF map implementation, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). When a value is updated in a percpu_hash or lru_percpu_hash map that contains special fields (BPF_KPTR_REF or BPF_KPTR_PERCPU), the old value's special fields are not freed via bpf_obj_free_fields() before being overwritten by copy_map_value() or copy_map_value_long(). The fix adds a call to bpf_obj_free_fields() after the copy operation in pcpu_copy_value() to ensure proper cleanup. Exploitation requires local access and low privileges — specifically the ability to load and run BPF programs — making it a local attack vector with low complexity (Microsoft MSRC).

Successful exploitation allows a local, low-privileged user to cause a denial of service through progressive memory exhaustion. By repeatedly updating per-CPU hash map entries containing special BPF pointer fields, an attacker can accumulate unreleased kernel memory until the system becomes unresponsive or the kernel is forced to restart. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems running vulnerable Linux kernel versions that support BPF operations on percpu_hash and lru_percpu_hash map types are at risk (Microsoft MSRC).

Apply available kernel patches addressing this vulnerability. For Microsoft Azure Linux 3, update to a patched kernel version beyond azl3_kernel_6.6.119.3-3. For upstream Linux kernel users, update to versions 6.12.63, 6.17.13, 6.18.2, or 6.19-rc1 or later, which include the fix in pcpu_copy_value(). Ubuntu users should apply security notices USN-8179-1 through USN-8179-4, USN-8184-1, USN-8185-1, USN-8185-2, USN-8203-1, USN-8258-1, USN-8260-1, and USN-8265-1 as applicable to their kernel variant. As a workaround, restrict unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl if BPF is not required for non-privileged users (Microsoft MSRC).