---
id: CVE-2025-38202
title: 'bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

  bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf
  program. When BPF JIT is …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 <
    2f8c69a72e8ad87b36b8052f789da3cc2b2e186c
  - >-
    Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 <
    7bf4461f1c97207fda757014690d55a447ce859f
  - >-
    Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 <
    2d834477bbc1e8b8a59ff8b0c081529d6bed7b22
  - >-
    Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 <
    b522d4d334f206284b1a44b0b0b2f99fd443b39b
  - >-
    Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 <
    d4965578267e2e81f67c86e2608481e77e9c8569
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:51:20.798575Z'
published: '2025-07-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:52:20.508Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38202'
references:
  - url: 'https://git.kernel.org/stable/c/2f8c69a72e8ad87b36b8052f789da3cc2b2e186c'
  - url: 'https://git.kernel.org/stable/c/7bf4461f1c97207fda757014690d55a447ce859f'
  - url: 'https://git.kernel.org/stable/c/2d834477bbc1e8b8a59ff8b0c081529d6bed7b22'
  - url: 'https://git.kernel.org/stable/c/b522d4d334f206284b1a44b0b0b2f99fd443b39b'
  - url: 'https://git.kernel.org/stable/c/d4965578267e2e81f67c86e2608481e77e9c8569'
tags:
  - cve.org
epss: 0.00184
epssPercentile: 0.08059
ingestedAt: '2026-11-05T22:38:31.930Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf
program. When BPF JIT is disabled or under 32-bit host,
bpf_map_lookup_percpu_elem() will not be inlined. Using it in a
sleepable bpf program will trigger the warning in
bpf_map_lookup_percpu_elem(), because the bpf program only holds
rcu_read_lock_trace lock. Therefore, add the missed check.

## Affected

- `Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 < 2f8c69a72e8ad87b36b8052f789da3cc2b2e186c`
- `Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 < 7bf4461f1c97207fda757014690d55a447ce859f`
- `Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 < 2d834477bbc1e8b8a59ff8b0c081529d6bed7b22`
- `Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 < b522d4d334f206284b1a44b0b0b2f99fd443b39b`
- `Linux >= 07343110b293456d30393e89b86c4dee1ac051c8 < d4965578267e2e81f67c86e2608481e77e9c8569`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.