{"id":"CVE-2025-38502","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix oob access in cgroup local storage\n\nLonial reported that an out-of-bounds access in cgroup local storage\ncan be crafted via tail calls","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix oob access in cgroup local storage\n\nLonial reported that an out-of-bounds access in cgroup local storage\ncan be crafted via tail calls. Given two programs each…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-125"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.9, < 5.15.192","linux_kernel >= 5.16, < 6.1.151","linux_kernel >= 6.2, < 6.6.105","linux_kernel >= 6.7, < 6.12.46","linux_kernel >= 6.13, < 6.16.1","debian_linux = 11.0","simatic_cn_4100_firmware < 5.0"],"patched":["linux_kernel 6.16.1","simatic_cn_4100_firmware 5.0"],"published":"2025-08-16","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:18:43.353","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-38502","references":[{"url":"https://git.kernel.org/stable/c/19341d5c59e8c7e8528e40f8663e99d67810473c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41688d1fc5d163a6c2c0e95c0419e2cb31a44648","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66da7cee78590259b400e51a70622ccd41da7bb2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7acfa07c585e3d7a64654d38f0a5c762877d0b9b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abad3d0bad72a52137e0c350c59542d75ae4f513","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1c74584b9b4043c52e41fec415226e582d266a3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00177,"epssPercentile":0.07261,"exploits":{"github":1,"githubRepos":["https://github.com/abraxas/CVE-2025-38502-Linux-LPE"],"checkedAt":"2026-10-27T18:12:44.899Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:51:03.238888Z"},"ingestedAt":"2026-10-15T22:48:25.509Z","slug":"CVE-2025-38502","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix oob access in cgroup local storage\n\nLonial reported that an out-of-bounds access in cgroup local storage\ncan be crafted via tail calls. Given two programs each utilizing a\ncgroup local storage with a different value size, and one program\ndoing a tail call into the other. The verifier will validate each of\nthe indivial programs just fine. However, in the runtime context\nthe bpf_cg_run_ctx holds an bpf_prog_array_item which contains the\nBPF program as well as any cgroup local storage flavor the program\nuses. Helpers such as bpf_get_local_storage() pick this up from the\nruntime context:\n\n  ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);\n  storage = ctx->prog_item->cgroup_storage[stype];\n\n  if (stype == BPF_CGROUP_STORAGE_SHARED)\n    ptr = &READ_ONCE(storage->buf)->data[0];\n  else\n    ptr = this_cpu_ptr(storage->percpu_buf);\n\nFor the second program which was called from the originally attached\none, this means bpf_get_local_storage() will pick up the former\nprogram's map, not its own. With mismatching sizes, this can result\nin an unintended out-of-bounds access.\n\nTo fix this issue, we need to extend bpf_map_owner with an array of\nstorage_cookie[] to match on i) the exact maps from the original\nprogram if the second program was using bpf_get_local_storage(), or\nii) allow the tail call combination if the second program was not\nusing any of the cgroup local storage maps.\n\n## Affected\n\n- `linux_kernel >= 5.9, < 5.15.192`\n- `linux_kernel >= 5.16, < 6.1.151`\n- `linux_kernel >= 6.2, < 6.6.105`\n- `linux_kernel >= 6.7, < 6.12.46`\n- `linux_kernel >= 6.13, < 6.16.1`\n- `debian_linux = 11.0`\n- `simatic_cn_4100_firmware < 5.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.16.1`\n- `simatic_cn_4100_firmware 5.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}