CVE-2025-38060

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. The verifier, a security mechanism that checks BPF programs for safety, incorrectly handles certain program states. This oversight could allow a local attacker to bypass security checks, enabling the execution of unsafe code. Successful exploitation may lead to a denial of service or potentially privilege escalation within the system.

A flaw of MODERATE impact was found in the Linux kernel's BPF verifier in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS. The copy_verifier_state() function did not copy the bpf_verifier_state.loop_entry field, so loop_entry values from unrelated verifier states could poison env->cur_state, and states in env->stack could incorrectly retain a non-NULL loop_entry. As a result, the verifier could accept BPF programs that are not actually safe. A local attacker with the privileges needed to load BPF programs could exploit this flaw to bypass the verifier's safety checks and execute unsafe code, which could lead to a denial of service (kernel crash) or potentially privilege escalation. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Red Hat rates this flaw MODERATE (CVSS 4.4) rather than the upstream CVE record severity of 7.8 because successful exploitation requires high privileges to load BPF programs and the verified impact is primarily to system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.