---
id: CVE-2025-38502
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix oob access in cgroup local storage

  Lonial reported that an out-of-bounds access in cgroup local storage
  can be crafted via tail calls
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix oob access in cgroup local storage

  Lonial reported that an out-of-bounds access in cgroup local storage
  can be crafted via tail calls. Given two programs each…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.9, < 5.15.192'
  - 'linux_kernel >= 5.16, < 6.1.151'
  - 'linux_kernel >= 6.2, < 6.6.105'
  - 'linux_kernel >= 6.7, < 6.12.46'
  - 'linux_kernel >= 6.13, < 6.16.1'
  - debian_linux = 11.0
  - simatic_cn_4100_firmware < 5.0
patched:
  - linux_kernel 6.16.1
  - simatic_cn_4100_firmware 5.0
published: '2025-08-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:43.353'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38502'
references:
  - url: 'https://git.kernel.org/stable/c/19341d5c59e8c7e8528e40f8663e99d67810473c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/41688d1fc5d163a6c2c0e95c0419e2cb31a44648'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/66da7cee78590259b400e51a70622ccd41da7bb2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7acfa07c585e3d7a64654d38f0a5c762877d0b9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/abad3d0bad72a52137e0c350c59542d75ae4f513'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c1c74584b9b4043c52e41fec415226e582d266a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-032379.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - exploit-available
  - cve.org
epss: 0.00177
epssPercentile: 0.07261
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/abraxas/CVE-2025-38502-Linux-LPE'
  checkedAt: '2026-10-27T18:12:44.899Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:51:03.238888Z'
ingestedAt: '2026-10-15T22:48:25.509Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix oob access in cgroup local storage

Lonial reported that an out-of-bounds access in cgroup local storage
can be crafted via tail calls. Given two programs each utilizing a
cgroup local storage with a different value size, and one program
doing a tail call into the other. The verifier will validate each of
the indivial programs just fine. However, in the runtime context
the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the
BPF program as well as any cgroup local storage flavor the program
uses. Helpers such as bpf_get_local_storage() pick this up from the
runtime context:

  ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);
  storage = ctx->prog_item->cgroup_storage[stype];

  if (stype == BPF_CGROUP_STORAGE_SHARED)
    ptr = &READ_ONCE(storage->buf)->data[0];
  else
    ptr = this_cpu_ptr(storage->percpu_buf);

For the second program which was called from the originally attached
one, this means bpf_get_local_storage() will pick up the former
program's map, not its own. With mismatching sizes, this can result
in an unintended out-of-bounds access.

To fix this issue, we need to extend bpf_map_owner with an array of
storage_cookie[] to match on i) the exact maps from the original
program if the second program was using bpf_get_local_storage(), or
ii) allow the tail call combination if the second program was not
using any of the cgroup local storage maps.

## Affected

- `linux_kernel >= 5.9, < 5.15.192`
- `linux_kernel >= 5.16, < 6.1.151`
- `linux_kernel >= 6.2, < 6.6.105`
- `linux_kernel >= 6.7, < 6.12.46`
- `linux_kernel >= 6.13, < 6.16.1`
- `debian_linux = 11.0`
- `simatic_cn_4100_firmware < 5.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.16.1`
- `simatic_cn_4100_firmware 5.0`