CVE-2025-38280

Description

CVE-2025-38280 is a vulnerability in the Linux kernel's BPF subsystem. The issue occurs when CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is set to 1. Under these conditions, the kernel attempts to JIT compile a BPF program, but if JIT compilation fails due to a condition like FAULT_INJECTION, the program is incorrectly marked as valid. When the program is subsequently run, it invokes __bpf_prog_ret0_warn, which triggers a WARN_ON_ONCE(1) warning [1][2].

Exploitation

The vulnerability can be triggered by an attacker with the ability to load BPF programs and who can influence the JIT compilation process (e.g., through fault injection). The attack does not require user interaction but does require local access or the ability to load BPF programs into the kernel. The attack path involves creating a BPF program and relying on the JIT compilation failure to lead to the warning [2].

Impact

Successful exploitation can result in a kernel panic (denial of service) due to the WARN_ON being triggered, which may cause the system to become unstable or crash. The CVSS v3 score is 7.8 (High), indicating a high severity impact on availability [1].

Mitigation

The vulnerability affects the Linux kernel versions where the bug is present. Patches have been committed to the kernel stable trees to fix the issue by properly handling JIT compilation failures and avoiding the invalid program state. Users should apply the relevant kernel updates or backport the fix from commits such as 0b9bb52796b2 [1][2][3][4].