CVE-2025-38280
published 2025-07-10CVE-2025-38280: In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU: 3…
high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
In the Linux kernel, the following vulnerability has been resolved:
bpf: Avoid __bpf_prog_ret0_warn when jit fails
syzkaller reported an issue:
WARNING: CPU: 3 PID: 217 at kernel/bpf/core.c:2357 __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Modules linked in:
CPU: 3 UID: 0 PID: 217 Comm: kworker/u32:6 Not tainted 6.15.0-rc4-syzkaller-00040-g8bac8898fe39
RIP: 0010:__bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Call Trace:
bpf_dispatcher_nop_func include/linux/bpf.h:1316 [inline]
__bpf_prog_run include/linux/filter.h:718 [inline]
bpf_prog_run include/linux/filter.h:725 [inline]
cls_bpf_classify+0x74a/0x1110 net/sched/cls_bpf.c:105
...
When creating bpf program, 'fp->jit_requested' depends on bpf_jit_enable.
This issue is triggered because of CONFIG_BPF_JIT_ALWAYS_ON is not set
and bpf_jit_enable is set to 1, causing the arch to attempt JIT the prog,
but jit failed due to FAULT_INJECTION. As a result, incorrectly
treats the program as valid, when the program runs it calls
`__bpf_prog_ret0_warn` and triggers the WARN_ON_ONCE(1).
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 4.14.140 < 4.15 | 4.15 |
| linux | linux | >= 4.9.190 < 4.10 | 4.10 |
| linux | linux | >= fa9dd599b4dae841924b022768354cfde9affecb < e7fb4ebee6e900899d2b2e5852c3e2eafcbcad66 | e7fb4ebee6e900899d2b2e5852c3e2eafcbcad66 |
| linux | linux | >= fa9dd599b4dae841924b022768354cfde9affecb < ef92b96530d1731d9ac167bc7c193c683cd78fff | ef92b96530d1731d9ac167bc7c193c683cd78fff |
| linux | linux | >= fa9dd599b4dae841924b022768354cfde9affecb < 6f639c25bfad17d9fd7379ab91ff9678ea9aac85 | 6f639c25bfad17d9fd7379ab91ff9678ea9aac85 |
| linux | linux | >= fa9dd599b4dae841924b022768354cfde9affecb < 2bc6dffb4b72d53d6a6ada510269bf548c3f7ae0 | 2bc6dffb4b72d53d6a6ada510269bf548c3f7ae0 |
| linux | linux | >= fa9dd599b4dae841924b022768354cfde9affecb < 0b9bb52796b239de6792d0d68cdc6eb505ebff96 | 0b9bb52796b239de6792d0d68cdc6eb505ebff96 |
| linux | linux | >= fa9dd599b4dae841924b022768354cfde9affecb < 86bc9c742426a16b52a10ef61f5b721aecca2344 | 86bc9c742426a16b52a10ef61f5b721aecca2344 |
| linux | linux_kernel | >= 0 < 6.1.147-1 | 6.1.147-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 5.15.0-156.166 | 5.15.0-156.166 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 4.14.140 < 4.15 | 4.15 |
| linux | linux_kernel | >= 4.16 < 5.15.186 | 5.15.186 |
| linux | linux_kernel | >= 4.9.190 < 4.10 | 4.10 |
| linux | linux_kernel | >= 5.16 < 6.1.142 | 6.1.142 |
| linux | linux_kernel | >= 6.13 < 6.15.3 | 6.15.3 |
| linux | linux_kernel | >= 6.2 < 6.6.94 | 6.6.94 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH