Executive brief
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow a local attacker to cause a system crash. The issue occurs when the system fails to properly handle memory during certain internal updates, leading to an invalid memory access. This primarily impacts system availability and could lead to a denial-of-service condition on affected devices, including certain industrial controllers.
Technical details
A NULL pointer dereference or invalid memory access vulnerability exists in the Linux kernel BPF subsystem. When 'update_effective_progs' fails (e.g., due to memory allocation failure during fault injection), the kernel may replace a valid BPF program with a 'dummy_bpf_prog'. If a softirq occurs subsequently, the kernel attempts to access 'prog->stats' on this dummy program, which may be NULL, triggering an invalid access in '__bpf_prog_run'. The fix involves adding a check to skip statistics updates if the stats pointer is NULL. This issue affects various stable kernel branches and has been observed in Siemens SIMATIC S7-1500 MFP devices using affected kernel versions.
Affected products
- Linux Linux Kernel 5.1 to 6.12.y
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-11-15: disclosed: Initial patch submitted by Pu Lehui
- 2025-12-18: patched: Commits merged into stable branches
- 2025-12-24: advisory: CVE-2025-68742 published
References
- https://git.kernel.org/stable/c/2579c356ccd35d06238b176e4b460978186d804b
- https://git.kernel.org/stable/c/539137e3038ce6f953efd72110110f03c14c7d97
- https://git.kernel.org/stable/c/56905bb70c8b88421709bb4e32fcba617aa37d41
- https://git.kernel.org/stable/c/7dc211c1159d991db609bdf4b0fb9033c04adcbc
- https://git.kernel.org/stable/c/93d1964773ff513c9bd530f7686d3e48b786fa6b
- https://git.kernel.org/stable/c/bf2c990b012100610c0f1ec5c4ea434da2d080c2
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html