CVE-2025-38528

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) bprintf helpers. A highly privileged local user could exploit this by providing a specially crafted format string, such as "%p%", to the bpf_trace_printk function. This improper handling of the format string by the bpf_bprintf_prepare function can lead to a kernel warning at runtime, resulting in a denial of service (DoS).

A low impact denial of service flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) bprintf helpers. A highly privileged local user could pass a specially crafted format string, such as "%p%", to the bpf_trace_printk() helper; the bpf_bprintf_prepare() function improperly skips over the trailing percent sign detected as punctuation while processing %p, so the format string is not rejected and a kernel WARNING is triggered at runtime, resulting in a denial of service of the affected system. There is no impact to confidentiality or integrity.

The Red Hat Enterprise Linux 6 and 7 kernels are not affected because the vulnerable code is not present in those releases. For affected Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1 releases, the fix has been deferred to a future update because the flaw is rated low impact: exploitation requires highly privileged local access, and the residual risk is limited to a runtime kernel warning causing local denial of service.

The CVEORG record scores this flaw 7.1 (IMPORTANT) with high confidentiality impact; Red Hat rates it LOW severity (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) because the available technical evidence shows only a runtime kernel warning and availability impact, with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.