---
id: CVE-2025-38060
title: 'bpf: copy_verifier_state() should copy ''loop_entry'' field'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: copy_verifier_state() should copy 'loop_entry' field

  The bpf_verifier_state.loop_entry state should be copied by
  copy_verifier_state(). Otherwise, .loop_entry val…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c8f6d285825f61d619c4c2509bfd75eb366db900 <
    b7867e55cbcbaed8498b6b96855371eb9afebdc7
  - >-
    Linux >= 2a0992829ea3864939d917a5c7b48be6629c6217 <
    46ba5757a7a4714e7d3f68cfe118208822cb3d78
  - >-
    Linux >= 2a0992829ea3864939d917a5c7b48be6629c6217 <
    8b4afd89fa75f738a80ca849126fd3cad77bcbf1
  - >-
    Linux >= 2a0992829ea3864939d917a5c7b48be6629c6217 <
    bbbc02b7445ebfda13e4847f4f1413c6480a85a9
  - Linux >= 6.6.15 < 6.6.160
  - Linux 6.7
published: '2025-06-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:36:41.334Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38060'
references:
  - url: 'https://git.kernel.org/stable/c/b7867e55cbcbaed8498b6b96855371eb9afebdc7'
  - url: 'https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78'
  - url: 'https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1'
  - url: 'https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9'
tags:
  - cve.org
epss: 0.00243
epssPercentile: 0.15392
ingestedAt: '2026-10-21T12:48:53.708Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: copy_verifier_state() should copy 'loop_entry' field

The bpf_verifier_state.loop_entry state should be copied by
copy_verifier_state(). Otherwise, .loop_entry values from unrelated
states would poison env->cur_state.

Additionally, env->stack should not contain any states with
.loop_entry != NULL. The states in env->stack are yet to be verified,
while .loop_entry is set for states that reached an equivalent state.
This means that env->cur_state->loop_entry should always be NULL after
pop_stack().

See the selftest in the next commit for an example of the program that
is not safe yet is accepted by verifier w/o this fix.

This change has some verification performance impact for selftests:

File                                Program                       Insns (A)  Insns (B)  Insns   (DIFF)  States (A)  States (B)  States (DIFF)
----------------------------------  ----------------------------  ---------  ---------  --------------  ----------  ----------  -------------
arena_htab.bpf.o                    arena_htab_llvm                     717        426  -291 (-40.59%)          57          37  -20 (-35.09%)
arena_htab_asm.bpf.o                arena_htab_asm                      597        445  -152 (-25.46%)          47          37  -10 (-21.28%)
arena_list.bpf.o                    arena_list_del                      309        279    -30 (-9.71%)          23          14   -9 (-39.13%)
iters.bpf.o                         iter_subprog_check_stacksafe        155        141    -14 (-9.03%)          15          14    -1 (-6.67%)
iters.bpf.o                         iter_subprog_iters                 1094       1003    -91 (-8.32%)          88          83    -5 (-5.68%)
iters.bpf.o                         loop_state_deps2                    479        725  +246 (+51.36%)          46          63  +17 (+36.96%)
kmem_cache_iter.bpf.o               open_coded_iter                      63         59     -4 (-6.35%)           7           6   -1 (-14.29%)
verifier_bits_iter.bpf.o            max_words                            92         84     -8 (-8.70%)           8           7   -1 (-12.50%)
verifier_iterating_callbacks.bpf.o  cond_break2                         113        107     -6 (-5.31%)          12          12    +0 (+0.00%)

And significant negative impact for sched_ext:

File               Program                 Insns (A)  Insns (B)  Insns         (DIFF)  States (A)  States (B)  States      (DIFF)
-----------------  ----------------------  ---------  ---------  --------------------  ----------  ----------  ------------------
bpf.bpf.o          lavd_init                    7039      14723      +7684 (+109.16%)         490        1139     +649 (+132.45%)
bpf.bpf.o          layered_dispatch            11485      10548         -937 (-8.16%)         848         762       -86 (-10.14%)
bpf.bpf.o          layered_dump                 7422    1000001  +992579 (+13373.47%)         681       31178  +30497 (+4478.27%)
bpf.bpf.o          layered_enqueue             16854      71127     +54273 (+322.02%)        1611        6450    +4839 (+300.37%)
bpf.bpf.o          p2dq_dispatch                 665        791        +126 (+18.95%)          68          78       +10 (+14.71%)
bpf.bpf.o          p2dq_init                    2343       2980        +637 (+27.19%)         201         237       +36 (+17.91%)
bpf.bpf.o          refresh_layer_cpumasks      16487     674760   +658273 (+3992.68%)        1770       65370  +63600 (+3593.22%)
bpf.bpf.o          rusty_select_cpu             1937      40872    +38935 (+2010.07%)         177        3210   +3033 (+1713.56%)
scx_central.bpf.o  central_dispatch              636       2687      +2051 (+322.48%)          63         227     +164 (+260.32%)
scx_nest.bpf.o     nest_init                     636        815        +179 (+28.14%)          60          73       +13 (+21.67%)
scx_qmap.bpf.o     qmap_dispatch      
---truncated---

## Affected

- `Linux >= c8f6d285825f61d619c4c2509bfd75eb366db900 < b7867e55cbcbaed8498b6b96855371eb9afebdc7`
- `Linux >= 2a0992829ea3864939d917a5c7b48be6629c6217 < 46ba5757a7a4714e7d3f68cfe118208822cb3d78`
- `Linux >= 2a0992829ea3864939d917a5c7b48be6629c6217 < 8b4afd89fa75f738a80ca849126fd3cad77bcbf1`
- `Linux >= 2a0992829ea3864939d917a5c7b48be6629c6217 < bbbc02b7445ebfda13e4847f4f1413c6480a85a9`
- `Linux >= 6.6.15 < 6.6.160`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.