CVE-2025-68355 in Linux
Summary
by MITRE • 12/24/2025
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix exclusive map memory leak
When excl_prog_hash is 0 and excl_prog_hash_size is non-zero, the map also needs to be freed. Otherwise, the map memory will not be reclaimed, just like the memory leak problem reported by syzbot [1].
syzbot reported: BUG: memory leak backtrace (crc 7b9fb9b4): map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512 __sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/27/2025
The vulnerability CVE-2025-68355 represents a critical memory management flaw within the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem that manifests as an exclusive map memory leak. This issue specifically affects the BPF map creation functionality where certain conditions trigger improper memory deallocation, leading to persistent memory consumption that can degrade system performance and potentially enable resource exhaustion attacks. The vulnerability was identified through automated testing by syzbot, which detected the memory leak pattern during BPF map creation operations.
The technical root cause of this vulnerability lies in the conditional logic governing BPF map memory cleanup within the kernel's BPF subsystem. When the exclusive program hash value (excl_prog_hash) equals zero while the exclusive program hash size (excl_prog_hash_size) remains non-zero, the kernel fails to properly free the associated map memory structures. This creates a scenario where memory allocated for BPF maps becomes orphaned and unreclaimable, effectively causing a memory leak that persists until the system is rebooted. The flaw exists in the map_create function within kernel/bpf/syscall.c at line 1512, where the memory deallocation logic does not account for this specific edge case condition.
The operational impact of this vulnerability extends beyond simple memory consumption issues to potentially compromise system stability and availability. Attackers could exploit this weakness by repeatedly creating BPF maps under the affected conditions, gradually consuming available system memory and potentially causing system instability or denial of service scenarios. The vulnerability affects systems running Linux kernels that implement the BPF subsystem, particularly those utilizing BPF programs that require exclusive map management. This memory leak could be particularly problematic in containerized environments or systems running multiple BPF-based applications that frequently create and destroy map structures.
Mitigation strategies for CVE-2025-68355 should prioritize applying the kernel patch that corrects the conditional memory deallocation logic in the BPF subsystem. System administrators should monitor for memory usage patterns that indicate potential memory leaks and implement regular system maintenance schedules to prevent accumulation of leaked memory. The fix ensures that when excl_prog_hash is zero and excl_prog_hash_size is non-zero, the associated map memory is properly freed regardless of the conditional state. This vulnerability aligns with CWE-401, which addresses improper resource release or memory leaks, and could be categorized under ATT&CK technique T1499.001 for resource exhaustion attacks. Organizations should also consider implementing memory monitoring tools to detect abnormal memory consumption patterns that might indicate exploitation of this vulnerability.