CVE-2025-38586

A flaw was found in the Linux kernel's ARM64 BPF (Berkeley Packet Filter) JIT (Just-In-Time) compiler. This vulnerability occurs when a BPF program is configured as an exception boundary, causing the frame pointer to be improperly initialized. A local attacker with low privileges could exploit this to trigger a kernel crash, resulting in a Denial of Service (DoS) for the system.

A flaw of low impact was found in the Linux kernel's ARM64 BPF JIT compiler. When a BPF program is configured as an exception boundary, find_used_callee_regs() is not called and ctx->fp_used remains false, so the frame pointer is not set up in the JIT-generated prologue even when the program uses it. A local attacker able to load a crafted BPF program acting as an exception boundary could exploit this to cause a kernel crash through a page fault, resulting in a denial of service. There is no impact on the confidentiality or integrity of the system.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 1 are affected, and the fix is currently deferred given the low security impact of this local denial-of-service condition; the residual risk is limited to system availability on the affected local host. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases.

Red Hat rates this flaw as Low severity (CVSS 4.4) because triggering it requires high privileges on the affected local system, which is lower than the NIST score of 5.5. The CVE.org score of 7.8, which includes high confidentiality and integrity impacts, is not supported by the technical evidence, which demonstrates only a denial-of-service impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.