---
id: CVE-2025-68208
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: account for current allocated stack depth in widen_imprecise_scalars()

  The usage pattern for widen_imprecise_scalars() looks as follows:

      prev_st = find_prev_…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: account for current allocated stack depth in widen_imprecise_scalars()

  The usage pattern for widen_imprecise_scalars() looks as follows:

      prev_st = find_prev_…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2025-12-16'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68208'
references:
  - url: 'https://git.kernel.org/stable/c/57e04e2ff56e32f923154f0f7bc476fcb596ffe7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64b12dca2b0abcb5fc0542887d18b926ea5cf711'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9944c7938cd5b3f37b0afec0481c7c015e4f1c58'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b0c8e6d3d866b6a7f73877f71968dbffd27b7785'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00154
epssPercentile: 0.04047
ingestedAt: '2026-10-14T13:30:58.454Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: account for current allocated stack depth in widen_imprecise_scalars()

The usage pattern for widen_imprecise_scalars() looks as follows:

    prev_st = find_prev_entry(env, ...);
    queued_st = push_stack(...);
    widen_imprecise_scalars(env, prev_st, queued_st);

Where prev_st is an ancestor of the queued_st in the explored states
tree. This ancestor is not guaranteed to have same allocated stack
depth as queued_st. E.g. in the following case:

    def main():
      for i in 1..2:
        foo(i)        // same callsite, differnt param

    def foo(i):
      if i == 1:
        use 128 bytes of stack
      iterator based loop

Here, for a second 'foo' call prev_st->allocated_stack is 128,
while queued_st->allocated_stack is much smaller.
widen_imprecise_scalars() needs to take this into account and avoid
accessing bpf_verifier_state->frame[*]->stack out of bounds.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.