Junglewise Threat Intelligence

CVE-2025-38502: Linux Kernel out-of-bounds access in BPF cgroup local storage

CVE-2025-38502 · Severity: high · CVSS 7.1 · Published 2025-08-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's BPF subsystem could allow a local attacker to access memory outside of intended boundaries. This occurs when specific types of programs (cgroup local storage) interact through 'tail calls,' potentially leading to the exposure of sensitive kernel data or causing a system crash. The issue affects various versions of the Linux kernel used in many enterprise and consumer operating systems.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the Linux kernel's BPF implementation due to improper handling of cgroup local storage during tail calls. When a BPF program performs a tail call into another program, the `bpf_get_local_storage()` helper may incorrectly retrieve the storage map of the caller instead of the callee. If these maps have different value sizes, it results in OOB access because the runtime context (`bpf_cg_run_ctx`) does not sufficiently distinguish between the storage requirements of the chained programs. An attacker with local privileges to load BPF programs can exploit this to read sensitive kernel memory. The fix involves extending `bpf_map_owner` with `storage_cookie[]` to ensure map compatibility during tail calls.

Affected products

  • Linux Linux Kernel 5.9 to 5.15.192, 5.16 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.46, 6.13 to 6.16.1

Timeline

  • 2025-07-31: patched: Initial patch authored by Daniel Borkmann
  • 2025-08-16: disclosed: CVE-2025-38502 published

References

Related threats