CVE-2025-38012: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
In the Linux kernel, the following vulnerability has been resolved:
schedext: bpfiterscxdsqnew() should always initialize iterator
BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpfforeach() macro ignores error returns from new()). bpfiterscxdsqnew() could leave the iterator in an uninitialized state after an error return causing bpfiterscxdsqnext() to dereference garbage data. Make bpfiterscxdsqnew() always clear $kit->dsq so that next() and destroy() become noops.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is rated with local attack vector and low privileges required. No user interaction is required.
What program behavior triggers the vulnerable path?
A BPF program must use the sched_ext dispatch-queue iterator and call next() or destroy() after the iterator's new() operation returns an error. The affected implementation could then dereference uninitialized iterator state.