CVE-2025-38489: s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again
In the Linux kernel, the following vulnerability has been resolved:
s390/bpf: Fix bpfarchtextpoke() with newaddr == NULL again
Commit 7ded842b356d ("s390/bpf: Fix bpfplt pointer arithmetic") has accidentally removed the critical piece of commit c730fce7c70c ("s390/bpf: Fix bpfarchtextpoke() with newaddr == NULL"), causing intermittent kernel panics in e.g. perf's onswitch() prog to reappear.
Restore the fix and add a comment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch c730fce7c70c
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38489?
The severity of CVE-2025-38489 is currently classified as a moderate risk due to its potential impact on the Linux kernel's stability.
How do I fix CVE-2025-38489?
To fix CVE-2025-38489, you should update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38489?
CVE-2025-38489 affects various versions of the Linux kernel, particularly those used in Linux-based operating systems.
What are the consequences of exploiting CVE-2025-38489?
Exploiting CVE-2025-38489 could lead to system instability and may result in disruptions to services relying on the Linux kernel.
Who resolved CVE-2025-38489?
CVE-2025-38489 was resolved by contributors to the Linux kernel, specifically through the commit addressing s390/bpf pointer arithmetic.