CVE-2025-38607

In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset (if a & b ...) as a jump in CFG computation BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the following example: 1: r0 = 1; 2: r2 = 2; 3: if r1 & 0x7 goto +1; 4: exit; 5: r0 = r2; 6: exit; W/o this fix insn_successors(3) will return only (4), a jump to (5) would be missed and r2 won't be marked as alive at (3).

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a	Patch
https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5	Patch
https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

26 Nov 2025, 17:40

Type	Values Removed	Values Added
CPE		cpe:2.3:o:linux:linux_kernel::::::::
References	~~() https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a -~~	() https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a - Patch
References	~~() https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5 -~~	() https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5 - Patch
References	~~() https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e -~~	() https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e - Patch
First Time		Linux linux Kernel Linux
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CWE		NVD-CWE-noinfo

Information

Published : 2025-08-19 17:15

Updated : 2025-11-26 17:40

NVD link : CVE-2025-38607

Mitre link : CVE-2025-38607

CVE.ORG link : CVE-2025-38607

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-38607", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-08-19T17:15:39.070", "references": [{"url": "https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: handle jset (if a & b ...) as a jump in CFG computation\n\nBPF_JSET is a conditional jump and currently verifier.c:can_jump()\ndoes not know about that. This can lead to incorrect live registers\nand SCC computation.\n\nE.g. in the following example:\n\n 1: r0 = 1;\n 2: r2 = 2;\n 3: if r1 & 0x7 goto +1;\n 4: exit;\n 5: r0 = r2;\n 6: exit;\n\nW/o this fix insn_successors(3) will return only (4), a jump to (5)\nwould be missed and r2 won't be marked as alive at (3)."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: manejar jset (si a & b ...) como un salto en el c\u00e1lculo CFG. BPF_JSET es un salto condicional y actualmente verifier.c:can_jump() no lo detecta. Esto puede provocar registros activos y c\u00e1lculos SCC incorrectos. Por ejemplo, en el siguiente ejemplo: 1: r0 = 1; 2: r2 = 2; 3: si r1 & 0x7 goto +1; 4: salir; 5: r0 = r2; 6: salir; Sin esta correcci\u00f3n, insn_successors(3) solo devolver\u00e1 (4), se omitir\u00eda un salto a (5) y r2 no se marcar\u00eda como activo en (3)."}], "lastModified": "2025-11-26T17:40:41.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EA7D98E-F04C-44BE-AC61-F5ADC4C88EC6", "versionEndExcluding": "6.15.10", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58182352-D7DF-4CC9-841E-03C1D852C3FB", "versionEndExcluding": "6.16.1", "versionStartIncluding": "6.16"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}