CVE-2025-38591Medium· 5.5▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Last analysed / modified upstream
— → 5.5
none → medium
5.5 → —
medium → none
— → 5.5
none → medium
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject narrower access to pointer ctx fields
The following BPF program, simplified from a syzkaller repro, causes a kernel warning:
r0 = *(u8 *)(r1 + 169);
exit;
With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning:
verifier bug: error during ctx access conversion(1)
This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction.
The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency.
Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 7847c4140e06f6e87229faae22cc38525334c156Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < feae34c992eb7191862fb1594c704fbbf650fef8Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 33660d44e789edb4f303210c813fc56d56377a90Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e2e9599f3503df7cf3569d2b6c50d5488fb59435Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 058a0da4f6d916a79b693384111bb80a90d73763Linux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < 202900ceeef67458c964c2af6e1427c8e533ea7cLinux >= f96da09473b52c09125cc9bf7d7d4576ae8229e0 < e09299225d5ba3916c91ef70565f7d2187e4cca0Linux 4.13Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-40196NoneIn the Linux kernel, the following vulnerability has been resolved: fs: quota: create dedicated workqueue for quota_release_work There is a kernel panic due to WARN_ONCE when panic_on_warn is set. This issue occurs when writeback is t…
CVE-2026-90055NoneIn the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid ci_range initialization syzbot reported a shift-out-of-bounds in __vcc_connect(): UBSAN: shift-out-of-bounds in net/atm/common.c:382:3…
CVE-2026-90060NoneIn the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that th…
CVE-2026-90168NoneRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-90196NoneIn the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table
CVE-2026-90209NoneIn the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ e…