CVE-2025-68378

What it actually does

Out-of-bounds write in the BPF stackmap bucket data array inside __bpf_get_stackid() when a perf trace contains more stack entries than the map bucket can store.

Why it matters to the business

Systems running affected Linux kernels may experience kernel memory corruption, leading to crashes, denial of service, or potential local privilege escalation; organizations using BPF-based observability or security tools face elevated risk until kernels are updated, with Chainguard opencost-fips users able to adopt the 1.114.0-r4 package immediately.

How an attack unfolds

An attacker with local access crafts or triggers a perf trace event whose stack trace exceeds the stackmap bucket capacity, causing __bpf_get_stackid() to copy beyond the allocated bucket data array and corrupt adjacent kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit d1f424a77b6bd27b361737ed73df49a0158f1590 or later; Chainguard opencost-fips users should update to version 1.114.0-r4.

How to confirm the fix worked

Confirm the running kernel contains commit d1f424a77b6bd27b361737ed73df49a0158f1590 or verify the opencost-fips package reports version 1.114.0-r4; re-run BPF stackmap tests that previously triggered KASAN reports to ensure they no longer produce slab-out-of-bounds writes.

Typical attack path

1. Obtain local code execution on an affected Linux system
2. Trigger or supply a perf trace containing more stack entries than the target stackmap bucket size
3. Invoke __bpf_get_stackid() to copy the oversized trace
4. Achieve out-of-bounds write into the bucket data array
5. Leverage resulting memory corruption for denial of service or further exploitation

How to detect it

Search kernel logs for KASAN slab-out-of-bounds write reports originating from __bpf_get_stackid(); inspect audit logs for unusual perf_event_open or BPF map creation activity preceding crashes.

What your security team should do

• Prioritize kernel updates on all systems that compile or load custom BPF programs
• Apply the Chainguard 1.114.0-r4 package where opencost-fips is in use
• Monitor for new upstream stable releases that include the referenced commit
• Restrict unprivileged BPF program loading until patches are deployed