Junglewise Threat Intelligence

CVE-2025-38285: Linux Kernel reachable assertion in BPF tracepoints

CVE-2025-38285 · Severity: medium · CVSS 5.5 · Published 2025-07-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. Under specific conditions involving nested system calls, the kernel could trigger an internal warning and potentially lead to a system crash or instability. This issue primarily affects system availability and could be exploited by a local user to disrupt operations.

Technical details

A vulnerability classified as a Reachable Assertion (CWE-617) exists in kernel/trace/bpf_trace.c within the get_bpf_raw_tp_regs function. The issue is triggered when specific tracepoints, such as trace_mmap_lock_acquire_returned, cause nested calls that exceed the expected nesting level, firing a WARN_ON_ONCE() macro. While the kernel handles the error by returning -EBUSY, the triggered warning can be used to cause kernel panic if 'panic_on_warn' is enabled or lead to log exhaustion. The fix involves removing the WARN_ON_ONCE() call to allow the system to handle the nested condition gracefully without triggering an assertion failure. Patching is available across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.19.57 to 4.20, 5.1.16 to 5.2, 5.2.1 to 5.4.295, 5.5 to 5.10.239, 5.11 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.94, 6.7 to 6.12.34, 6.13 to 6.15.3

Timeline

  • 2025-05-13: patched: Initial patch submitted to the BPF tree.
  • 2025-07-10: disclosed: CVE-2025-38285 published.

References

Related threats