Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-38607

bpf: handle jset (if a & b ...) as a jump in CFG computation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset (if a & b ...) as a jump in CFG computation BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the following example: 1: r0 = 1; 2: r2 = 2; 3: if r1 & 0x7 goto +1; 4: exit; 5: r0 = r2; 6: exit; W/o this fix insn_successors(3) will return only (4), a jump to (5) would be missed and r2 won't be marked as alive at (3).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 14c8552db64476ffc27c13dc6652fc0dac31c0ba to < 65eb166b8636365ad3d6e36d50a7c5edfe6cc66eaffected
  • 14c8552db64476ffc27c13dc6652fc0dac31c0ba to < 261b30ad1516f4b9edd500aa6e8d6315c8fc109aaffected
  • 14c8552db64476ffc27c13dc6652fc0dac31c0ba to < 3157f7e2999616ac91f4d559a8566214f74000a5affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.15.10 to ≤ 6.15.*unaffected
  • 6.16.1 to ≤ 6.16.*unaffected
  • 6.17 to ≤ *unaffected

References