CVE-2025-38591

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject narrower access to pointer ctx fields

The following BPF program, simplified from a syzkaller repro, causes a

kernel warning:

r0 = *(u8 *)(r1 + 169);

exit;

With pointer field sk being at offset 168 in __sk_buff. This access is

detected as a narrower read in bpf_skb_is_valid_access because it

doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed

and later proceeds to bpf_convert_ctx_access. Note that for the

"is_narrower_load" case in the convert_ctx_accesses(), the insn->off

is aligned, so the cnt may not be 0 because it matches the

offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,

the target_size stays 0 and the verifier errors with a kernel warning:

verifier bug: error during ctx access conversion(1)

This patch fixes that to return a proper "invalid bpf_context access

off=X size=Y" error on the load instruction.

The same issue affects multiple other f

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References