CVE-2025-38591

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. A local attacker can exploit this by crafting a malicious BPF program that attempts to access pointer context fields with an improperly narrow read. This improper access can lead to a verifier bug, causing a kernel warning and ultimately resulting in a Denial of Service (DoS) for the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict the use of unprivileged BPF programs. This can be achieved by setting the kernel.unprivileged_bpf_disabled sysctl parameter to 1. This change may impact applications that rely on unprivileged BPF. A system reboot or service reload may be required for the changes to take full effect.