Junglewise Threat Intelligence

CVE-2025-38280: Linux Kernel BPF JIT compilation failure handling vulnerability

CVE-2025-38280 · Severity: high · CVSS 7.8 · Published 2025-07-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem could allow a local user to trigger a system warning or potentially cause unstable behavior. The issue occurs when the system attempts to optimize network or security programs but fails, leading the kernel to incorrectly treat an invalid program as valid. This could be used by an attacker to disrupt system operations or gain unauthorized access.

Technical details

A logic error in 'kernel/bpf/core.c' exists where 'jit_needed' is incorrectly initialized to false in 'bpf_prog_select_runtime'. When 'CONFIG_BPF_JIT_ALWAYS_ON' is disabled but 'bpf_jit_enable' is active, a JIT failure (potentially induced via fault injection) causes the kernel to treat a BPF program as valid even if it hasn't been properly processed. When this program is later executed, it triggers '__bpf_prog_ret0_warn', resulting in a kernel WARN_ON_ONCE. This vulnerability allows a local attacker with the ability to load BPF programs to trigger kernel warnings and potentially exploit the resulting inconsistent state. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.9.190 to 4.10, 4.14.140 to 4.15, 4.16 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3

Timeline

  • 2025-05-26: patched: Initial fix authored by KaFai Wan
  • 2025-07-10: disclosed: CVE-2025-38280 published

References

Related threats