CVE-2025-38607
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/08/2025
Last modified:
26/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
bpf: handle jset (if a & b ...) as a jump in CFG computation<br />
<br />
BPF_JSET is a conditional jump and currently verifier.c:can_jump()<br />
does not know about that. This can lead to incorrect live registers<br />
and SCC computation.<br />
<br />
E.g. in the following example:<br />
<br />
1: r0 = 1;<br />
2: r2 = 2;<br />
3: if r1 & 0x7 goto +1;<br />
4: exit;<br />
5: r0 = r2;<br />
6: exit;<br />
<br />
W/o this fix insn_successors(3) will return only (4), a jump to (5)<br />
would be missed and r2 won&#39;t be marked as alive at (3).
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.15 (including) | 6.15.10 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.16 (including) | 6.16.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page