CVE-2025-39990: bpf: Check the helper function is valid in get_helper_proto
bpf: Check the helper function is valid in gethelperproto
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Mark the BPF tail_call helper function with BPF_PTR_POISON so the helper func pointer is treated as poisoned/invalid when unused.
Linux kernel BPF verifier BPF_PTR_POISON (mark tail_call helper func pointer poisoning) = enabled for tail_call helper func (by design) - Configuration
In get_helper_proto, add a direct check that the helper function is valid to prevent the helper func pointer from being NULL when a config option disables it.
Linux kernel BPF verifier get_helper_proto helper validation = implemented direct validity check
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39990?
CVE-2025-39990 has a medium severity rating due to its potential to allow NULL pointer dereferences.
How do I fix CVE-2025-39990?
To fix CVE-2025-39990, ensure that you update your Linux kernel to the latest version where this vulnerability has been resolved.
What software is affected by CVE-2025-39990?
CVE-2025-39990 affects the Linux kernel, specifically in its BPF component.
What type of vulnerability is CVE-2025-39990?
CVE-2025-39990 is a verifier bug related to the BPF helper function in the Linux kernel.
Can CVE-2025-39990 lead to exploitation?
Yes, CVE-2025-39990 could potentially be exploited to cause system instability via NULL pointer dereference.