CVE-2025-38502

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix oob access in cgroup local storage

Lonial reported that an out-of-bounds access in cgroup local storage

can be crafted via tail calls. Given two programs each utilizing a

cgroup local storage with a different value size, and one program

doing a tail call into the other. The verifier will validate each of

the indivial programs just fine. However, in the runtime context

the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the

BPF program as well as any cgroup local storage flavor the program

uses. Helpers such as bpf_get_local_storage() pick this up from the

runtime context:

ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);

storage = ctx->prog_item->cgroup_storage[stype];

if (stype == BPF_CGROUP_STORAGE_SHARED)

ptr = &READ_ONCE(storage->buf)->data[0];

else

ptr = this_cpu_ptr(storage->percpu_buf);

For the second program which was called from the originally attach

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References