CVE-2025-39990

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the helper function is valid in get_helper_proto

kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design.

[1] https://lore.kernel.org/oe-lkp/[email protected]

A low-impact NULL pointer dereference flaw in the Linux kernel BPF verifier affects the kernel and kernel-rt components of Red Hat Enterprise Linux 7, 8, 9, and 10, and Red Hat In-Vehicle OS 1. When the kernel configuration option that provides a BPF helper function implementation is disabled, the helper function pointer returned by get_helper_proto() can be NULL, and a BPF program that uses such a helper can trigger a NULL pointer dereference during verifier processing, resulting in a kernel crash (denial of service). Red Hat Product Security rated this flaw Low impact because exploiting it requires local privileged access to load BPF programs and only system availability is affected (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This differs from the CVE.org severity of 7.8, which additionally assumes confidentiality and integrity impacts that the Red Hat assessment did not identify. The Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel is not affected because the vulnerable code is not present in that stream. Given the low impact and the local, privileged attack vector, fixes for the affected streams are currently deferred; the residual risk is limited to a local denial of service by an already-privileged user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.