In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix kmemleak warning for percpu hashmap
Vlad Poenaru reported the following kmemleak issue:
unreferenced object 0x606fd7c44ac8 (size 32): backtrace (crc 0): pcpuallocnoprof+0x730/0xeb0 bpfmapallocpercpu+0x69/0xc0 preallocinit+0x9d/0x1b0 htabmapalloc+0x363/0x510 mapcreate+0x215/0x3a0 _sysbpf+0x16b/0x3e0 _x64sysbpf+0x18/0x20 dosyscall64+0x7b/0x150 entrySYSCALL64afterhwframe+0x4b/0x53
Further investigation shows the reason is due to not 8-byte aligned store of percpu pointer in htabelemsetptr(): *(void _percpu **)(l->key + key_size) = pptr;
Note that the whole htabelem alignment is 8 (for x8664). If the keysize is 4, that means pptr is stored in a location which is 4 byte aligned but not 8 byte aligned. In mm/kmemleak.c, scanblock() scans the memory based on 8 byte stride, so it won't detect above pptr, hence reporting the memory leak.
In htabmapalloc(), we already have
htab->elem_size = sizeof(struct htab_elem) +
round_up(htab->map.key_size, 8);
if (percpu)
htab->elem_size += sizeof(void *);
else
htab->elem_size += round_up(htab->map.value_size, 8);
So storing pptr with 8-byte alignment won't cause any problem and can fix kmemleak too.
The issue can be reproduced with bpf selftest as well: 1. Enable CONFIGDEBUGKMEMLEAK config 2. Add a getchar() before skel destroy in testhashmap() in progtests/foreach.c. The purpose is to keep map available so kmemleak can be detected. 3. run './testprogs -t foreach/hash_map &' and a kmemleak should be reported.
[
{
"id": "CVE-2025-37807-0c42ce14",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_elem_set_ptr"
},
"digest": {
"function_hash": "85822874459281511090568377656305792257",
"length": 131.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7758e308aeda1038aba1944f7302d34161b3effe"
},
{
"id": "CVE-2025-37807-172f451a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_percpu_map_gen_lookup"
},
"digest": {
"function_hash": "151270739089536474112172274418756884056",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11ba7ce076e5903e7bdc1fd1498979c331b3c286"
},
{
"id": "CVE-2025-37807-2fa0758d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"digest": {
"line_hashes": [
"238126287573593296326455212725883681839",
"314450725959470261285732294841654911197",
"240959500313706688788062408904364122966",
"117524949162149737953674450059976870754",
"151869155233522996832202513084350495486",
"274845963725021045702013489908281244767",
"303649486642639003068860728675042324471",
"219621993113718041312284440855514185111",
"181433252970309039338913402835594478485",
"121422331637465944797987330861426779665",
"32545608310934249019822149508258664716",
"78919846788351597757248378976743756504"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11ba7ce076e5903e7bdc1fd1498979c331b3c286"
},
{
"id": "CVE-2025-37807-3c41eca4",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_elem_get_ptr"
},
"digest": {
"function_hash": "113971868240514900503209300630842963838",
"length": 116.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1c29aa1934177349c17e3c32e68ec38a7a56df"
},
{
"id": "CVE-2025-37807-3dbf12e1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_elem_get_ptr"
},
"digest": {
"function_hash": "113971868240514900503209300630842963838",
"length": 116.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11ba7ce076e5903e7bdc1fd1498979c331b3c286"
},
{
"id": "CVE-2025-37807-5571153f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_elem_set_ptr"
},
"digest": {
"function_hash": "85822874459281511090568377656305792257",
"length": 131.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11ba7ce076e5903e7bdc1fd1498979c331b3c286"
},
{
"id": "CVE-2025-37807-5a006186",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_percpu_map_gen_lookup"
},
"digest": {
"function_hash": "151270739089536474112172274418756884056",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1c29aa1934177349c17e3c32e68ec38a7a56df"
},
{
"id": "CVE-2025-37807-6089dc00",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"digest": {
"line_hashes": [
"238126287573593296326455212725883681839",
"314450725959470261285732294841654911197",
"240959500313706688788062408904364122966",
"117524949162149737953674450059976870754",
"151869155233522996832202513084350495486",
"274845963725021045702013489908281244767",
"303649486642639003068860728675042324471",
"219621993113718041312284440855514185111",
"181433252970309039338913402835594478485",
"121422331637465944797987330861426779665",
"32545608310934249019822149508258664716",
"78919846788351597757248378976743756504"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1c29aa1934177349c17e3c32e68ec38a7a56df"
},
{
"id": "CVE-2025-37807-b69807f3",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_elem_get_ptr"
},
"digest": {
"function_hash": "113971868240514900503209300630842963838",
"length": 116.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7758e308aeda1038aba1944f7302d34161b3effe"
},
{
"id": "CVE-2025-37807-d2d42d1e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_percpu_map_gen_lookup"
},
"digest": {
"function_hash": "151270739089536474112172274418756884056",
"length": 584.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7758e308aeda1038aba1944f7302d34161b3effe"
},
{
"id": "CVE-2025-37807-e8a399b6",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "kernel/bpf/hashtab.c"
},
"digest": {
"line_hashes": [
"238126287573593296326455212725883681839",
"314450725959470261285732294841654911197",
"240959500313706688788062408904364122966",
"117524949162149737953674450059976870754",
"151869155233522996832202513084350495486",
"274845963725021045702013489908281244767",
"303649486642639003068860728675042324471",
"219621993113718041312284440855514185111",
"181433252970309039338913402835594478485",
"121422331637465944797987330861426779665",
"32545608310934249019822149508258664716",
"78919846788351597757248378976743756504"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7758e308aeda1038aba1944f7302d34161b3effe"
},
{
"id": "CVE-2025-37807-fb0ecaa0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "kernel/bpf/hashtab.c",
"function": "htab_elem_set_ptr"
},
"digest": {
"function_hash": "85822874459281511090568377656305792257",
"length": 131.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f1c29aa1934177349c17e3c32e68ec38a7a56df"
}
]