CVE-2025-22087

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.

2. For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.

3. For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

This vulnerability is rated as Moderate impact because successful exploitation requires local user access with elevated capabilities to load crafted eBPF programs, restricting the blast radius. In standard Red Hat Enterprise Linux environments, unprivileged eBPF execution is restricted by default, preventing unprivileged users from loading programs into the kernel. Additionally, the vulnerable code introducing the may_goto instruction is absent from default enterprise releases, leaving supported platforms unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.