{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38060", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.979Z", "datePublished": "2025-06-18T09:33:39.610Z", "dateUpdated": "2026-08-05T11:59:09.528Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:09.528Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: copy_verifier_state() should copy 'loop_entry' field\n\nThe bpf_verifier_state.loop_entry state should be copied by\ncopy_verifier_state(). Otherwise, .loop_entry values from unrelated\nstates would poison env->cur_state.\n\nAdditionally, env->stack should not contain any states with\n.loop_entry != NULL. The states in env->stack are yet to be verified,\nwhile .loop_entry is set for states that reached an equivalent state.\nThis means that env->cur_state->loop_entry should always be NULL after\npop_stack().\n\nSee the selftest in the next commit for an example of the program that\nis not safe yet is accepted by verifier w/o this fix.\n\nThis change has some verification performance impact for selftests:\n\nFile Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)\n---------------------------------- ---------------------------- --------- --------- -------------- ---------- ---------- -------------\narena_htab.bpf.o arena_htab_llvm 717 426 -291 (-40.59%) 57 37 -20 (-35.09%)\narena_htab_asm.bpf.o arena_htab_asm 597 445 -152 (-25.46%) 47 37 -10 (-21.28%)\narena_list.bpf.o arena_list_del 309 279 -30 (-9.71%) 23 14 -9 (-39.13%)\niters.bpf.o iter_subprog_check_stacksafe 155 141 -14 (-9.03%) 15 14 -1 (-6.67%)\niters.bpf.o iter_subprog_iters 1094 1003 -91 (-8.32%) 88 83 -5 (-5.68%)\niters.bpf.o loop_state_deps2 479 725 +246 (+51.36%) 46 63 +17 (+36.96%)\nkmem_cache_iter.bpf.o open_coded_iter 63 59 -4 (-6.35%) 7 6 -1 (-14.29%)\nverifier_bits_iter.bpf.o max_words 92 84 -8 (-8.70%) 8 7 -1 (-12.50%)\nverifier_iterating_callbacks.bpf.o cond_break2 113 107 -6 (-5.31%) 12 12 +0 (+0.00%)\n\nAnd significant negative impact for sched_ext:\n\nFile Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)\n----------------- ---------------------- --------- --------- -------------------- ---------- ---------- ------------------\nbpf.bpf.o lavd_init 7039 14723 +7684 (+109.16%) 490 1139 +649 (+132.45%)\nbpf.bpf.o layered_dispatch 11485 10548 -937 (-8.16%) 848 762 -86 (-10.14%)\nbpf.bpf.o layered_dump 7422 1000001 +992579 (+13373.47%) 681 31178 +30497 (+4478.27%)\nbpf.bpf.o layered_enqueue 16854 71127 +54273 (+322.02%) 1611 6450 +4839 (+300.37%)\nbpf.bpf.o p2dq_dispatch 665 791 +126 (+18.95%) 68 78 +10 (+14.71%)\nbpf.bpf.o p2dq_init 2343 2980 +637 (+27.19%) 201 237 +36 (+17.91%)\nbpf.bpf.o refresh_layer_cpumasks 16487 674760 +658273 (+3992.68%) 1770 65370 +63600 (+3593.22%)\nbpf.bpf.o rusty_select_cpu 1937 40872 +38935 (+2010.07%) 177 3210 +3033 (+1713.56%)\nscx_central.bpf.o central_dispatch 636 2687 +2051 (+322.48%) 63 227 +164 (+260.32%)\nscx_nest.bpf.o nest_init 636 815 +179 (+28.14%) 60 73 +13 (+21.67%)\nscx_qmap.bpf.o qmap_dispatch \n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached through the local `bpf(BPF_PROG_LOAD)` syscall when the in-kernel verifier analyses an attacker-supplied program. No network or adjacent-network path exists.\nAC:L - The attacker fully controls the BPF instruction stream and therefore the verifier's DFS/state-graph traversal; the upstream selftest is a deterministic reproducer, and the `BPF_F_TEST_STATE_FREQ` flag that makes checkpointing fully predictable requires no extra privilege. No condition lies outside the attacker's control.\nPR:L - Loading a program containing iterator kfuncs requires CAP_BPF (`env->bpf_capable`), which is a non-root capability commonly delegated to unprivileged service accounts and, since 6.9, to user namespaces via BPF tokens — the verifier itself is the security boundary such a caller is supposed to be confined by. This is basic-user-level privilege, not init-namespace root.\nUI:N - The attacker loads and runs its own BPF program; no action by any other user or administrator is needed.\nS:U - The unsound verification and the resulting memory corruption both occur within the kernel's own security authority; no hypervisor, IOMMU, or VM boundary is crossed.\nC:H - The accepted program obtains pointer arithmetic on `r10` with a register the verifier believes is a proven constant but which is attacker-controlled at runtime, yielding arbitrary kernel memory reads that can be exfiltrated to userspace through a BPF map.\nI:H - The same primitive gives an unvalidated `*(u64 *)(r10 + reg) = value` store with no JIT-emitted bounds check, i.e. arbitrary kernel memory write leading to privilege escalation and control-flow hijacking — the classic verifier-soundness LPE pattern.\nA:H - Writes to kernel memory that the verifier never validated corrupt kernel stack/heap state, reliably producing an oops or panic even when full exploitation is not attempted." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/verifier.c" ], "versions": [ { "version": "2a0992829ea3864939d917a5c7b48be6629c6217", "lessThan": "46ba5757a7a4714e7d3f68cfe118208822cb3d78", "status": "affected", "versionType": "git" }, { "version": "2a0992829ea3864939d917a5c7b48be6629c6217", "lessThan": "8b4afd89fa75f738a80ca849126fd3cad77bcbf1", "status": "affected", "versionType": "git" }, { "version": "2a0992829ea3864939d917a5c7b48be6629c6217", "lessThan": "bbbc02b7445ebfda13e4847f4f1413c6480a85a9", "status": "affected", "versionType": "git" }, { "version": "c8f6d285825f61d619c4c2509bfd75eb366db900", "status": "affected", "versionType": "git" }, { "version": "6.6.15", "lessThan": "6.7", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/bpf/verifier.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.14.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.15" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78" }, { "url": "https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1" }, { "url": "https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9" } ], "title": "bpf: copy_verifier_state() should copy 'loop_entry' field", "x_generator": { "engine": "bippy-1.2.0" } } } }