Junglewise Threat Intelligence

CVE-2025-39748: Linux Kernel BPF verifier range invariant violation in JSET

CVE-2025-39748 · Severity: medium · CVSS 5.5 · Published 2025-09-11

Technologies: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) verifier, a component responsible for ensuring that custom network and system programs are safe to run. The issue involves how the verifier tracks data ranges during specific logical operations, which could lead to internal kernel errors or crashes. While primarily affecting Linux-based systems, this also impacts certain industrial controllers from Siemens that utilize affected kernel versions.

Technical details

A range invariant violation exists in the Linux kernel BPF verifier's handling of the JSET instruction. When the verifier refines register bounds (tnums) after a JSET, it may fail to recognize unreachable code paths, leading to inconsistent register states where the minimum value exceeds the maximum value (e.g., umin=1, umax=0). This occurs because the verifier's branch tracking (is_branch_taken) does not correctly account for sign extensions during JSET operations. An attacker with the ability to load BPF programs could trigger this invariant violation, leading to kernel warnings or potential denial-of-service. The fix involves marking registers as unbounded (__mark_reg_unbounded) before narrowing tnums after a JSET to prevent inconsistent states.

Affected products

  • Linux Linux Kernel 6.8 to 6.12 (fixed in various stable branches)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2025-07-10: disclosed: Initial patch authored by Paul Chaignon
  • 2025-09-11: advisory: CVE published
  • 2026-03-25: patched: Patch committed to stable tree by Greg Kroah-Hartman

References

Related threats