{"id":"CVE-2025-68208","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2025-12-16","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-68208","references":[{"url":"https://git.kernel.org/stable/c/57e04e2ff56e32f923154f0f7bc476fcb596ffe7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64b12dca2b0abcb5fc0542887d18b926ea5cf711","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9944c7938cd5b3f37b0afec0481c7c015e4f1c58","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0c8e6d3d866b6a7f73877f71968dbffd27b7785","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00154,"epssPercentile":0.04047,"ingestedAt":"2026-10-14T13:30:58.454Z","slug":"CVE-2025-68208","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: account for current allocated stack depth in widen_imprecise_scalars()\n\nThe usage pattern for widen_imprecise_scalars() looks as follows:\n\n    prev_st = find_prev_entry(env, ...);\n    queued_st = push_stack(...);\n    widen_imprecise_scalars(env, prev_st, queued_st);\n\nWhere prev_st is an ancestor of the queued_st in the explored states\ntree. This ancestor is not guaranteed to have same allocated stack\ndepth as queued_st. E.g. in the following case:\n\n    def main():\n      for i in 1..2:\n        foo(i)        // same callsite, differnt param\n\n    def foo(i):\n      if i == 1:\n        use 128 bytes of stack\n      iterator based loop\n\nHere, for a second 'foo' call prev_st->allocated_stack is 128,\nwhile queued_st->allocated_stack is much smaller.\nwiden_imprecise_scalars() needs to take this into account and avoid\naccessing bpf_verifier_state->frame[*]->stack out of bounds.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}