CVE-2025-38280: bpf: Avoid __bpf_prog_ret0_warn when jit fails
In the Linux kernel, the following vulnerability has been resolved:
bpf: Avoid bpfprogret0warn when jit fails
syzkaller reported an issue:
WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 bpfprogret0warn+0xa/0x20 kernel/bpf/core.c:2357 Modules linked in: CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39 RIP: 0010:bpfprogret0warn+0xa/0x20 kernel/bpf/core.c:2357 Call Trace: <TASK> bpfdispatchernopfunc include/linux/bpf.h:1316 [inline] bpfprogrun include/linux/filter.h:718 [inline] bpfprogrun include/linux/filter.h:725 [inline] clsbpfclassify+0x74a/0x1110 net/sched/clsbpf.c:105 ...
When creating bpf program, 'fp->jitrequested' depends on bpfjitenable. This issue is triggered because of CONFIGBPFJITALWAYSON is not set and bpfjitenable is set to 1, causing the arch to attempt JIT the prog, but jit failed due to FAULTINJECTION. As a result, incorrectly treats the program as valid, when the program runs it calls bpfprogret0warn and triggers the WARNONONCE(1).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38280?
The severity of CVE-2025-38280 is considered moderate, as it pertains to a specific handling issue in the Linux kernel.
How do I fix CVE-2025-38280?
To fix CVE-2025-38280, upgrade to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2025-38280?
CVE-2025-38280 affects various versions of the Linux kernel, particularly those using BPF (Berkeley Packet Filter).
What could happen if CVE-2025-38280 is exploited?
If exploited, CVE-2025-38280 could potentially lead to a denial of service condition in the affected Linux systems.
Is there a workaround for CVE-2025-38280?
Currently, there are no specific workarounds for CVE-2025-38280, so updating the kernel is the recommended approach.