CVE-2025-68742

What it actually does

Invalid memory access to prog->stats when update_effective_progs fails due to fault-injected allocation, causing purge_effective_progs to substitute a dummy_bpf_prog whose stats pointer is NULL or invalid; a subsequent softirq in __cgroup_bpf_run_filter_skb then dereferences it during u64_stats_update_begin_irqsave.

Why it matters to the business

Kernel instability or crashes on systems running cgroup-attached BPF programs, with elevated operational risk for container platforms and network filtering workloads; low exploit probability but present in widely used Linux distributions and derived container images.

How an attack unfolds

An attacker with local access or the ability to trigger cgroup BPF attach/detach operations injects faults during update_effective_progs; this leads purge_effective_progs to install a dummy program, after which a softirq races in and dereferences invalid stats memory before the static branch is decremented.

How to fix it

Upgrade the Linux kernel to commit 93d1964773ff513c9bd530f7686d3e48b786fa6b or later; for affected Chainguard Harbor images update to 2.9.5-r15 or newer releases that incorporate the fixed kernel.

How to confirm the fix worked

Confirm kernel source contains the stats NULL check before u64_stats_update_begin_irqsave; verify running kernel version or container image digest matches a fixed release; test cgroup BPF attach/detach under memory-pressure fault injection.

Typical attack path

1. Trigger __cgroup_bpf_detach on a cgroup with attached programs
2. Inject fault in bpf_prog_array_alloc inside compute_effective_progs
3. Allow purge_effective_progs to replace the program entry with dummy_bpf_prog.prog
4. Schedule softirq that executes __cgroup_bpf_run_filter_skb and bpf_prog_run
5. Access NULL or invalid stats pointer inside u64_stats_update_begin_irqsave

How to detect it

Review kernel logs for invalid memory access or Oops in bpf_prog_run / __cgroup_bpf_run_filter_skb paths; inspect audit logs for frequent cgroup BPF attach/detach operations coinciding with allocation failures; no public threat actor campaigns are associated with this issue.

What your security team should do

• Prioritize kernel and Harbor image upgrades on all systems using cgroup BPF programs
• Monitor EPSS and exploit maturity; current values indicate low immediate external risk
• Apply updates before the next scheduled maintenance window given 306 days since disclosure
• Harden fault-injection and syzkaller-style testing environments to prevent regression