{"id":"CVE-2025-38591","title":"bpf: Reject narrower access to pointer ctx fields","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"nvd","vendor":"Linux","product":"Linux","affected":["Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 7847c4140e06f6e87229faae22cc38525334c156","Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < feae34c992eb7191862fb1594c704fbbf650fef8","Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 33660d44e789edb4f303210c813fc56d56377a90","Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e2e9599f3503df7cf3569d2b6c50d5488fb59435","Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 058a0da4f6d916a79b693384111bb80a90d73763","Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 202900ceeef67458c964c2af6e1427c8e533ea7c","Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e09299225d5ba3916c91ef70565f7d2187e4cca0","Linux 4.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:41:20.077651Z"},"published":"2025-08-19","updated":"2026-09-14","sourceUpdated":"2026-09-14T11:58:03.288Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38591","references":[{"url":"https://git.kernel.org/stable/c/7847c4140e06f6e87229faae22cc38525334c156"},{"url":"https://git.kernel.org/stable/c/feae34c992eb7191862fb1594c704fbbf650fef8"},{"url":"https://git.kernel.org/stable/c/33660d44e789edb4f303210c813fc56d56377a90"},{"url":"https://git.kernel.org/stable/c/e2e9599f3503df7cf3569d2b6c50d5488fb59435"},{"url":"https://git.kernel.org/stable/c/058a0da4f6d916a79b693384111bb80a90d73763"},{"url":"https://git.kernel.org/stable/c/202900ceeef67458c964c2af6e1427c8e533ea7c"},{"url":"https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["cve.org","nvd"],"epss":0.00197,"epssPercentile":0.09771,"patched":["linux_kernel 6.16.1"],"ingestedAt":"2026-09-08T15:33:26.997Z","slug":"CVE-2025-38591","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n    exit;\n\nWith pointer field sk being at offset 168 in __sk_buff. This access is\ndetected as a narrower read in bpf_skb_is_valid_access because it\ndoesn't match offsetof(struct __sk_buff, sk). It is therefore allowed\nand later proceeds to bpf_convert_ctx_access. Note that for the\n\"is_narrower_load\" case in the convert_ctx_accesses(), the insn->off\nis aligned, so the cnt may not be 0 because it matches the\noffsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,\nthe target_size stays 0 and the verifier errors with a kernel warning:\n\n    verifier bug: error during ctx access conversion(1)\n\nThis patch fixes that to return a proper \"invalid bpf_context access\noff=X size=Y\" error on the load instruction.\n\nThe same issue affects multiple other fields in context structures that\nallow narrow access. Some other non-affected fields (for sk_msg,\nsk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for\nconsistency.\n\nNote this syzkaller crash was reported in the \"Closes\" link below, which\nused to be about a different bug, fixed in\ncommit fce7bd8e385a (\"bpf/verifier: Handle BPF_LOAD_ACQ instructions\nin insn_def_regno()\"). Because syzbot somehow confused the two bugs,\nthe new crash and repro didn't get reported to the mailing list.\n\n## Affected\n\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 7847c4140e06f6e87229faae22cc38525334c156`\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < feae34c992eb7191862fb1594c704fbbf650fef8`\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 33660d44e789edb4f303210c813fc56d56377a90`\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e2e9599f3503df7cf3569d2b6c50d5488fb59435`\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 058a0da4f6d916a79b693384111bb80a90d73763`\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 202900ceeef67458c964c2af6e1427c8e533ea7c`\n- `Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e09299225d5ba3916c91ef70565f7d2187e4cca0`\n- `Linux 4.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":201408,"id":"CVE-2025-38591","ts":1789399414277,"field":"cvss","old":null,"new":"5.5"},{"seq":201407,"id":"CVE-2025-38591","ts":1789399414277,"field":"severity","old":"none","new":"medium"},{"seq":200143,"id":"CVE-2025-38591","ts":1789396816446,"field":"cvss","old":"5.5","new":null},{"seq":200142,"id":"CVE-2025-38591","ts":1789396816446,"field":"severity","old":"medium","new":"none"},{"seq":199318,"id":"CVE-2025-38591","ts":1789395378160,"field":"cvss","old":null,"new":"5.5"},{"seq":199317,"id":"CVE-2025-38591","ts":1789395378160,"field":"severity","old":"none","new":"medium"}]}