CVE-2025-38640

A flaw was found in the Linux kernel. A local attacker can exploit a vulnerability in the BPF (Berkeley Packet Filter) netfilter component. By calling the BPF program without migration disabled in the transmit path, an attacker can trigger an assertion failure in __bpf_prog_run(). This can lead to a kernel panic, resulting in a Denial of Service (DoS) on the system.

A low impact denial of service flaw was found in the Linux kernel BPF netfilter hook implementation (nf_hook_run_bpf in net/netfilter/nf_bpf_link.c). When a BPF program attached to a netfilter hook runs in the network transmit path, migration is not disabled, so the non-migratable-context assertion in __bpf_prog_run() fails and the kernel panics. A local attacker with the privileges required to attach a BPF program to a netfilter hook can use this to crash the system, causing a denial of service; the flaw affects availability only and cannot be used to compromise confidentiality or integrity. For this reason the Red Hat severity of Low (CVSS 4.4) differs from the upstream CVEORG rating of Important (7.8), which assumes impact to confidentiality and integrity as well.

The BPF netfilter hook code that contains this flaw is not present in Red Hat Enterprise Linux 6, 7, or 8, so the kernel and kernel-rt packages in those releases are not affected. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1 (kernel) contain the vulnerable code and are affected; the fix is deferred to a future kernel update because this is a low-impact denial of service that requires highly privileged local access to exploit. The residual risk of deferral is that such a privileged local user could trigger a kernel panic, but cannot gain additional privileges or access or modify data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.