CVE-2025-38586: bpf, arm64: Fix fp initialization for exception boundary
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix fp initialization for exception boundary
In the ARM64 BPF JIT when prog->aux->exceptionboundary is set for a BPF program, findusedcalleeregs() is not called because for a program acting as exception boundary, all callee saved registers are saved. findusedcalleeregs() sets ctx->fpused = true; when it sees FP being used in any of the instructions.
For programs acting as exception boundary, ctx->fpused remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault.
Fix it by setting ctx->fpused = true for exception boundary programs as fp is always saved in such programs.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38586?
CVE-2025-38586 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38586?
To fix CVE-2025-38586, ensure that you update to the latest patched version of the Linux kernel where the vulnerability has been resolved.
What type of systems are affected by CVE-2025-38586?
CVE-2025-38586 affects systems running the Linux Kernel where BPF programs utilize the ARM64 architecture.
What functionality is impacted by CVE-2025-38586?
CVE-2025-38586 impacts the initialization of floating-point registers in the ARM64 BPF JIT under certain programming conditions.
Is CVE-2025-38586 likely to be exploited?
While the likelihood of exploitation depends on specific use cases, the presence of this vulnerability does pose a risk in environments where affected software is deployed.