Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or potentially gain unauthorized access. The issue occurs when the system processes network traffic using specific security filters (Netfilter) combined with custom scripts (BPF). This could lead to operational downtime or a compromise of the server's integrity.
Technical details
A vulnerability exists in nf_hook_run_bpf() within the Linux kernel where BPF programs hooked into the Netfilter framework can be executed without migration being disabled in the transmit (xmit) path. This violates an assertion in __bpf_prog_run(), which assumes a non-migratable context. A local attacker could potentially exploit this to trigger a kernel panic (DoS) or achieve more complex memory corruption. The fix involves using bpf_prog_run_pin_on_cpu() to ensure the BPF program runs in a stable, non-migratable CPU context.
Affected products
- Linux Linux kernel fd9c663b9ad67 to 0a356da16fb933abbeeb7aea038c351f3342cd3f
Timeline
- 2025-08-22: advisory: NVD publication date
- 2025-07-22: patched: Initial patch authored by Kuniyuki Iwashima
References
- https://git.kernel.org/stable/c/0a356da16fb933abbeeb7aea038c351f3342cd3f
- https://git.kernel.org/stable/c/17ce3e5949bc37557305ad46316f41c7875d6366
- https://git.kernel.org/stable/c/62f6175d145e00fc999fd2fcbffad3f59253c66a
- https://git.kernel.org/stable/c/e0199c28167a8a4adec036005a8df268b2b68529
- https://git.kernel.org/stable/c/ee2502485702e4398cd74dbfb288bfa111d25e62