UBUNTU-CVE-2025-38586: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exceptionboundary is set for a BPF program, findusedcalleeregs() is not called because for a program acting as exception boundary, all callee saved registers are saved. findusedcalleeregs() sets ctx->fpused = true; when it sees FP being used in any of the instructions. For programs acting as exception boundary, ctx->fpused remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault. Fix it by setting ctx->fpused = true for exception boundary programs as fp is always saved in such programs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1020.21~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oem-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-oracle-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-36.36.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.14to a version that resolves this vulnerability.Fixed in 6.14.0-1016.16~24.04.1 - Configuration
Set ctx->fp_used = true for programs acting as exception boundaries, because the frame pointer is always saved in such programs.
ARM64 BPF JIT exception boundary programs ctx->fp_used = true