CVE-2025-22087

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22087
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly. 2. For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it. 3. For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/19e6817f84000d0b06f09fd69ebd56217842c122 Patch
https://git.kernel.org/stable/c/1a86ae57b2600e5749f5f674e9d4296ac00c69a8 Patch
https://git.kernel.org/stable/c/4524b7febdd55fb99ae2e1f48db64019fa69e643 Patch
https://git.kernel.org/stable/c/6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

31 Oct 2025, 20:57

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Corrección del error de los límites de la matriz con may_goto. may_goto utiliza 8 bytes adicionales en la pila, lo que provoca que la matriz interpreters[] salga de los límites al calcular el índice mediante stack_size. 1. Si se reescribe un programa BPF, reevalúe el tamaño de la pila. En casos que no sean JIT, rechace la carga directamente. 2. En casos que no sean JIT, el cálculo de interpreters[idx] puede seguir provocando un acceso a la matriz fuera de los límites y simplemente advertir al respecto. 3. En casos con jit_requested, también se debe advertir la ejecución de bpf_func. Por lo tanto, mueva la definición de la función __bpf_prog_ret0_warn fuera de la definición de la macro CONFIG_BPF_JIT_ALWAYS_ON.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
CWE CWE-125
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/19e6817f84000d0b06f09fd69ebd56217842c122 - () https://git.kernel.org/stable/c/19e6817f84000d0b06f09fd69ebd56217842c122 - Patch
References () https://git.kernel.org/stable/c/1a86ae57b2600e5749f5f674e9d4296ac00c69a8 - () https://git.kernel.org/stable/c/1a86ae57b2600e5749f5f674e9d4296ac00c69a8 - Patch
References () https://git.kernel.org/stable/c/4524b7febdd55fb99ae2e1f48db64019fa69e643 - () https://git.kernel.org/stable/c/4524b7febdd55fb99ae2e1f48db64019fa69e643 - Patch
References () https://git.kernel.org/stable/c/6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0 - () https://git.kernel.org/stable/c/6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0 - Patch

16 Apr 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-16 15:16

Updated : 2025-10-31 20:57

NVD link : CVE-2025-22087

Mitre link : CVE-2025-22087

CVE.ORG link : CVE-2025-22087

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read