CVE-2025-68216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Disable trampoline for kernel module function trace

The current LoongArch BPF trampoline implementation is incompatible

with tracing functions in kernel modules. This causes several severe

and user-visible problems:

* The `bpf_selftests/module_attach` test fails consistently.

* Kernel lockup when a BPF program is attached to a module function [1].

* Critical kernel modules like WireGuard experience traffic disruption

when their functions are traced with fentry [2].

Given the severity and the potential for other unknown side-effects, it

is safest to disable the feature entirely for now. This patch prevents

the BPF subsystem from allowing trampoline attachments to kernel module

functions on LoongArch.

This is a temporary mitigation until the core issues in the trampoline

code for kernel module handling can be identified and fixed.

[root@fedora bpf]# ./test_progs -a module_attach -v

bpf_testmod.ko

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References