CVE-2025-68378

bpf: Fix stackmap overflow check in __bpf_get_stackid()

State: Published
Severity: Not scored
Published: Dec 24, 2025
Updated: Oct 30, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stackmap overflow check in __bpf_get_stackid()

Syzkaller reported a KASAN slab-out-of-bounds write in __bpf_get_stackid() when copying stack trace data. The issue occurs when the perf trace contains more stack entries than the stack map bucket can hold, leading to an out-of-bounds write in the bucket's data array.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 03fe4c886667b3a09b9d6afc03bbc68afb35c82bAffected ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before d6028caa0ee39dccd005468adfa3223b92bd3ad3Affected ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before d1f424a77b6bd27b361737ed73df49a0158f1590Affected ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 2a008f6de163279deffd488c1deab081bce5667cAffected ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 4669a8db976c8cbd5427fe9945f12c5fa5168ff3Affected ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 23f852daa4bab4d579110e034e4d513f7d490846Affected 90805175a206f784b6a77f16f07b07f6803e286bAffected 398ac11f4425d1e52aaf0d05d4fc90524e1a5b5eAffected e750f78c4ed7cefbcefb9769b3b9e08033db39daAffected 6c4f243b58f5362e983386488b2d563764c567afAffected 5.10.110 to before 5.11Affected 5.15.33 to before 5.16Affected 5.16.19 to before 5.17Affected 5.17.2 to before 5.18Affected
LinuxLinux	5.18Affected before 5.18Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 03fe4c886667b3a09b9d6afc03bbc68afb35c82bAffected
ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before d6028caa0ee39dccd005468adfa3223b92bd3ad3Affected
ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before d1f424a77b6bd27b361737ed73df49a0158f1590Affected
ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 2a008f6de163279deffd488c1deab081bce5667cAffected
ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 4669a8db976c8cbd5427fe9945f12c5fa5168ff3Affected
ee2a098851bfbe8bcdd964c0121f4246f00ff41e to before 23f852daa4bab4d579110e034e4d513f7d490846Affected
90805175a206f784b6a77f16f07b07f6803e286bAffected
398ac11f4425d1e52aaf0d05d4fc90524e1a5b5eAffected
e750f78c4ed7cefbcefb9769b3b9e08033db39daAffected
6c4f243b58f5362e983386488b2d563764c567afAffected
5.10.110 to before 5.11Affected
5.15.33 to before 5.16Affected
5.16.19 to before 5.17Affected
5.17.2 to before 5.18Affected

LinuxLinux

5.18Affected
before 5.18Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.