CVE-2025-68744

What it actually does

Missing bpf_obj_free_fields() calls after copy_map_value in pcpu_copy_value() for percpu_hash and lru_percpu_hash maps allow BPF_KPTR_REF and BPF_KPTR_PERCPU fields to retain references to allocated objects until map destruction, causing a memory leak.

Why it matters to the business

Long-running systems that repeatedly update percpu hash maps containing kptr fields can experience gradual kernel memory exhaustion, leading to degraded performance or denial of service in affected Linux distributions.

How an attack unfolds

An attacker with the ability to load and update BPF programs targeting percpu hash maps that store kptr fields repeatedly performs map updates; each update leaks the prior kptr-referenced memory because the free call is absent, accumulating unreclaimed kernel allocations until the map or system is destroyed.

How to fix it

Upgrade to a fixed kernel version containing commit 120b8e527e07c65de7f2b9018dcd9d17e66f2427 or later; Debian 12 and 13 users should install linux 6.1.11-1 or newer packages; rebuild and redeploy any custom BPF programs after kernel update.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or package version; inspect pcpu_copy_value() source for the added bpf_obj_free_fields() call after copy_map_value; monitor kernel memory statistics during map-update workloads to verify leak absence.

Typical attack path

1. Obtain CAP_BPF or equivalent privileges to load BPF programs
2. Create a percpu_hash or lru_percpu_hash map containing BPF_KPTR_REF or BPF_KPTR_PERCPU fields
3. Perform repeated map updates via bpf_map_update_elem
4. Observe progressive kernel memory consumption without corresponding object release

How to detect it

Review kernel logs for repeated allocation warnings tied to BPF map operations; correlate high slab or percpu memory growth with bpf map update activity on systems running vulnerable kernels; examine BPF program load and map-update audit events for patterns involving kptr-containing maps.

What your security team should do

• Prioritize kernel upgrades on any system exposing BPF map operations to untrusted workloads
• Audit BPF programs for use of percpu hash maps with kptr fields and schedule testing after patch application
• Enable kernel memory accounting and alerting to detect anomalous allocation growth in production