{"id":"CVE-2025-68208","summary":"bpf: account for current allocated stack depth in widen_imprecise_scalars()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_entry(env, ...);\n    queued_st = push_stack(...);\n    widen_imprecise_scalars(env, prev_st, queued_st);\n\nWhere prev_st is an ancestor of the queued_st in the explored states\ntree. This ancestor is not guaranteed to have same allocated stack\ndepth as queued_st. E.g. in the following case:\n\n    def main():\n      for i in 1..2:\n        foo(i)        // same callsite, differnt param\n\n    def foo(i):\n      if i == 1:\n        use 128 bytes of stack\n      iterator based loop\n\nHere, for a second 'foo' call prev_st-\u003eallocated_stack is 128,\nwhile queued_st-\u003eallocated_stack is much smaller.\nwiden_imprecise_scalars() needs to take this into account and avoid\naccessing bpf_verifier_state-\u003eframe[*]-\u003estack out of bounds.","modified":"2026-04-02T13:03:23.255406Z","published":"2025-12-16T13:48:35.298Z","related":["MGASA-2026-0017","MGASA-2026-0018","SUSE-SU-2026:0278-1","SUSE-SU-2026:0281-1","SUSE-SU-2026:0315-1","SUSE-SU-2026:20207-1","SUSE-SU-2026:20220-1","SUSE-SU-2026:20228-1","SUSE-SU-2026:20477-1","SUSE-SU-2026:20498-1","SUSE-SU-2026:20845-1","SUSE-SU-2026:20876-1","openSUSE-SU-2026:20145-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68208.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/57e04e2ff56e32f923154f0f7bc476fcb596ffe7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/64b12dca2b0abcb5fc0542887d18b926ea5cf711"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9944c7938cd5b3f37b0afec0481c7c015e4f1c58"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b0c8e6d3d866b6a7f73877f71968dbffd27b7785"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68208.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68208"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ab470fefce2837e66b771c60858118d50bb5bb10"},{"fixed":"64b12dca2b0abcb5fc0542887d18b926ea5cf711"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2793a8b015f7f1caadb9bce9c63dc659f7522676"},{"fixed":"9944c7938cd5b3f37b0afec0481c7c015e4f1c58"},{"fixed":"57e04e2ff56e32f923154f0f7bc476fcb596ffe7"},{"fixed":"b0c8e6d3d866b6a7f73877f71968dbffd27b7785"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68208.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.117"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.59"},{"fixed":"6.17.9"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68208.json"}}],"schema_version":"1.7.5"}