CVE-2025-38060

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: copy_verifier_state() should copy 'loop_entry' field

The bpf_verifier_state.loop_entry state should be copied by

copy_verifier_state(). Otherwise, .loop_entry values from unrelated

states would poison env->cur_state.

Additionally, env->stack should not contain any states with

.loop_entry != NULL. The states in env->stack are yet to be verified,

while .loop_entry is set for states that reached an equivalent state.

This means that env->cur_state->loop_entry should always be NULL after

pop_stack().

See the selftest in the next commit for an example of the program that

is not safe yet is accepted by verifier w/o this fix.

This change has some verification performance impact for selftests:

File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)

---------------------------------- ---------------------------- --------- --------

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References