Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
CVE-2025-38591: Linux kernel BPF verifier may crash on narrow pointer reads
CVE-2025-38591 · published 1 year ago
Summary
The Linux kernel's BPF verification component could incorrectly handle small reads of certain internal data structures, leading to a kernel warning and possible crash. This affects several Linux kernel packages, including standard, Debian, and cloud-provider versions. Applying the latest kernel updates will resolve the problem.
What to do
- Update debian rootio-linux to version 6.12.63-1.root.io.64.
- Update debian rootio-linux to version 6.1.174-1.root.io.153.
- Update canonical linux-gcp-5.15 to version 5.15.0-1106.115~20.04.1.
- Update canonical linux-aws-6.8 to version 6.8.0-1057.60~22.04.1.
- Update canonical linux-azure-6.8 to version 6.8.0-1059.65~22.04.1.
- Update canonical linux-gcp-6.8 to version 6.8.0-1060.63~22.04.1.
- Update canonical linux-hwe-6.8 to version 6.8.0-124.124~22.04.1.
- Update canonical linux-nvidia-6.8 to version 6.8.0-1054.57~22.04.1.
- Update canonical linux-oracle-6.8 to version 6.8.0-1054.55~22.04.1.
- Update canonical linux-azure to version 6.8.0-1056.62.
- Update canonical linux-nvidia-tegra to version 6.8.0-1024.24.
- Update canonical linux-oracle to version 6.8.0-1054.55.
- Update canonical linux-xilinx to version 6.8.0-1032.33.
- Update canonical linux-azure-fips to version 6.8.0-1059.65+fips1.
- Update canonical linux-fips to version 6.8.0-116.116+fips1.
- Update canonical linux-bluefield to version 6.8.0-1022.26.
- Update canonical linux-aws-5.15 to version 5.15.0-1105.112~20.04.1.
- Update canonical linux-azure-5.15 to version 5.15.0-1110.119~20.04.1.
- Update canonical linux-hwe-5.15 to version 5.15.0-176.186~20.04.1.
- Update canonical linux-ibm-5.15 to version 5.15.0-1099.102~20.04.1.
- Update canonical linux-intel-iotg-5.15 to version 5.15.0-1100.106~20.04.1.
- Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-175.185~20.04.1.
- Update canonical linux-nvidia-tegra-5.15 to version 5.15.0-1057.57~20.04.1.
- Update canonical linux-oracle-5.15 to version 5.15.0-1102.108~20.04.1.
- Update canonical linux-riscv-5.15 to version 5.15.0-1099.103~20.04.1.
- Update canonical linux to version 5.15.0-176.186.
- Update canonical linux-aws to version 5.15.0-1105.112.
- Update canonical linux-azure to version 5.15.0-1110.119.
- Update canonical linux-gcp to version 5.15.0-1105.114.
- Update canonical linux-gke to version 5.15.0-1101.107.
- Update canonical linux-gkeop to version 5.15.0-1088.96.
- Update canonical linux-ibm to version 5.15.0-1099.102.
- Update canonical linux-ibm-6.8 to version 6.8.0-1055.56~22.04.1.
- Update canonical linux-intel-iotg to version 5.15.0-1100.106.
- Update canonical linux-kvm to version 5.15.0-1097.102.
- Update canonical linux-lowlatency to version 5.15.0-175.185.
- Update canonical linux-lowlatency-hwe-6.8 to version 6.8.0-117.117.1~22.04.1.
- Update canonical linux-nvidia to version 5.15.0-1100.101.
- Update canonical linux-nvidia-tegra to version 5.15.0-1057.57.
- Update canonical linux-nvidia-tegra-igx to version 5.15.0-1046.46.
- Update canonical linux-oracle to version 5.15.0-1102.108.
- Update canonical linux-raspi to version 5.15.0-1099.102.
- Update canonical linux-riscv-6.8 to version 6.8.0-117.117~22.04.1.
- Update canonical linux-xilinx-zynqmp to version 5.15.0-1070.74.
- Update canonical linux-bluefield to version 5.15.0-1089.91.
- Update canonical linux-aws-fips to version 5.15.0-1105.112+fips1.
- Update canonical linux-azure-fips to version 5.15.0-1110.119+fips1.
- Update canonical linux-fips to version 5.15.0-176.186+fips1.
- Update canonical linux-gcp-fips to version 5.15.0-1105.114+fips1.
- Update canonical linux-intel-iot-realtime to version 5.15.0-1097.99.
- Update canonical linux-realtime to version 5.15.0-1104.113.
- Update canonical linux-realtime-6.8 to version 6.8.1-1051.52~22.04.1.
- Update canonical linux to version 6.8.0-117.117.
- Update canonical linux-aws to version 6.8.0-1055.58.
- Update canonical linux-gcp to version 6.8.0-1058.61.
- Update canonical linux-gke to version 6.8.0-1054.60.
- Update canonical linux-gkeop to version 6.8.0-1041.44.
- Update canonical linux-ibm to version 6.8.0-1055.56.
- Update canonical linux-lowlatency to version 6.8.0-117.117.1.
- Update canonical linux-nvidia to version 6.8.0-1054.57.
- Update canonical linux-nvidia-lowlatency to version 6.8.0-1054.57.1.
- Update canonical linux-raspi to version 6.8.0-1056.60.
- Update canonical linux-aws-fips to version 6.8.0-1055.58+fips1.
- Update canonical linux-gcp-fips to version 6.8.0-1058.61+fips1.
- Update canonical linux-raspi-realtime to version 6.8.0-2045.46.
- Update canonical linux-realtime to version 6.8.1-1051.52.
- Update debian rootio-linux to version 5.10.249-1.root.io.52.
- Update debian rootio-linux to version 6.1.159-1.root.io.75.
- Update debian linux to version 6.12.101-1.aikido.158.
- Update debian rootio-linux to version 6.12.101-1.aikido.158.
- Update canonical linux to version 5.15.0-187.197.aikido.112.
- Update canonical rootio-linux to version 5.15.0-187.197.aikido.112.
- Update canonical linux to version 6.8.0-138.138.aikido.87.
- Update canonical rootio-linux to version 6.8.0-138.138.aikido.87.
- Update linux kernel to version 6.16.1.
- Update linux to version 6.8.0-146.146.aikido.89.
- Update rootio-linux to version 6.8.0-146.146.aikido.89.
- Update linux to version 5.15.0-198.208.aikido.116.
- Update rootio-linux to version 5.15.0-198.208.aikido.116.
- Update canonical linux-azure-fde to version 5.15.0-1114.123.
- Update canonical linux-azure-fde-6.8 to version 6.8.0-1058.65~22.04.1.
- Update canonical linux-azure-fde to version 6.8.0-1058.65.
- Update linux to version 6.8.0-147.147.aikido.90.
- Update rootio-linux to version 6.8.0-147.147.aikido.90.
- Update debian linux to version 6.1.162-1.
- Update debian linux to version 6.12.69-1.
- Update debian linux to version 6.16.3-1.
- Update linux to version 6.12.113-1.aikido.163.
- Update rootio-linux to version 6.12.113-1.aikido.163.
- Update linux to version 6.1.190-1.aikido.167.
- Update rootio-linux to version 6.1.190-1.aikido.167.
- Update linux to version 5.15.0-202.212.aikido.118.
- Update rootio-linux to version 5.15.0-202.212.aikido.118.
- Update linux linux_kernel to version 6.16.1 or later.
- Update linux linux to version 7847c4140e06f6e87229faae22cc38525334c156 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | linux | linux_kernel |
>= 4.13, < 6.16.1 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Root:Debian:13 | debian | rootio-linux |
< 6.12.63-1.root.io.64 < 6.12.101-1.aikido.158 Fix: upgrade to 6.12.63-1.root.io.64
|
| Root:Debian:12 | debian | rootio-linux |
< 6.1.174-1.root.io.153 < 6.1.159-1.root.io.75 Fix: upgrade to 6.1.174-1.root.io.153
|
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp-5.15 |
< 5.15.0-1106.115~20.04.1 Fix: upgrade to 5.15.0-1106.115~20.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-aws-6.8 |
< 6.8.0-1057.60~22.04.1 Fix: upgrade to 6.8.0-1057.60~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-azure-6.8 |
< 6.8.0-1059.65~22.04.1 Fix: upgrade to 6.8.0-1059.65~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.8 |
< 6.8.0-1060.63~22.04.1 Fix: upgrade to 6.8.0-1060.63~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.8 |
< 6.8.0-124.124~22.04.1 Fix: upgrade to 6.8.0-124.124~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.8 |
< 6.8.0-1054.57~22.04.1 Fix: upgrade to 6.8.0-1054.57~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.8 |
< 6.8.0-1054.55~22.04.1 Fix: upgrade to 6.8.0-1054.55~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux-azure |
< 6.8.0-1056.62 Fix: upgrade to 6.8.0-1056.62
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-tegra |
< 6.8.0-1024.24 Fix: upgrade to 6.8.0-1024.24
|
| Ubuntu:24.04:LTS | canonical | linux-oracle |
< 6.8.0-1054.55 Fix: upgrade to 6.8.0-1054.55
|
| Ubuntu:24.04:LTS | canonical | linux-xilinx |
< 6.8.0-1032.33 Fix: upgrade to 6.8.0-1032.33
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-azure-fips |
< 6.8.0-1059.65+fips1 Fix: upgrade to 6.8.0-1059.65+fips1
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-fips |
< 6.8.0-116.116+fips1 Fix: upgrade to 6.8.0-116.116+fips1
|
| – | linux | linux |
< 7847c4140e06f6e87229faae22cc38525334c156 4.13 |
| Ubuntu:Nvidia-BlueField:24.04:LTS | canonical | linux-bluefield |
< 6.8.0-1022.26 Fix: upgrade to 6.8.0-1022.26
|
| Ubuntu:Pro:14.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-aws-hwe | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:16.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.0 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-aws-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-aws-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-azure-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-azure-edge | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-gcp-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-4.15 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gke-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gkeop-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-hwe-5.4 | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-ibm-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oem | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.0 | All versions |
Showing 50 of 241. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | linux-oracle-5.3 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-oracle-5.4 | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | linux-raspi-5.4 | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:18.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-aws-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-aws-5.15 |
< 5.15.0-1105.112~20.04.1 Fix: upgrade to 5.15.0-1105.112~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-aws-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-5.15 |
< 5.15.0-1110.119~20.04.1 Fix: upgrade to 5.15.0-1110.119~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-azure-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-bluefield | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gcp-5.8 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-hwe-5.15 |
< 5.15.0-176.186~20.04.1 Fix: upgrade to 5.15.0-176.186~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-hwe-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-ibm-5.15 |
< 5.15.0-1099.102~20.04.1 Fix: upgrade to 5.15.0-1099.102~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-intel-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-intel-iotg-5.15 |
< 5.15.0-1100.106~20.04.1 Fix: upgrade to 5.15.0-1100.106~20.04.1
|
| Ubuntu:Pro:20.04:LTS | canonical | linux-iot | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-kvm | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-lowlatency-hwe-5.15 |
< 5.15.0-175.185~20.04.1 Fix: upgrade to 5.15.0-175.185~20.04.1
|
| Ubuntu:Pro:20.04:LTS | canonical | linux-nvidia-tegra-5.15 |
< 5.15.0-1057.57~20.04.1 Fix: upgrade to 5.15.0-1057.57~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oem-5.10 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.13 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.14 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oem-5.6 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.11 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.13 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-oracle-5.15 |
< 5.15.0-1102.108~20.04.1 Fix: upgrade to 5.15.0-1102.108~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-oracle-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-raspi | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.11 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-riscv-5.15 |
< 5.15.0-1099.103~20.04.1 Fix: upgrade to 5.15.0-1099.103~20.04.1
|
| Ubuntu:20.04:LTS | canonical | linux-riscv-5.8 | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-xilinx-zynqmp | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-updates:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS:20.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:22.04:LTS | canonical | linux |
< 5.15.0-176.186 Fix: upgrade to 5.15.0-176.186
|
| Ubuntu:22.04:LTS | canonical | linux-allwinner-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws |
< 5.15.0-1105.112 Fix: upgrade to 5.15.0-1105.112
|
| Ubuntu:22.04:LTS | canonical | linux-aws-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-aws-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure |
< 5.15.0-1110.119 Fix: upgrade to 5.15.0-1110.119
|
| Ubuntu:22.04:LTS | canonical | linux-azure-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde |
< 5.15.0-1114.123 Fix: upgrade to 5.15.0-1114.123
|
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-azure-fde-6.8 |
< 6.8.0-1058.65~22.04.1 Fix: upgrade to 6.8.0-1058.65~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-gcp |
< 5.15.0-1105.114 Fix: upgrade to 5.15.0-1105.114
|
| Ubuntu:22.04:LTS | canonical | linux-gcp-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gcp-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-gke |
< 5.15.0-1101.107 Fix: upgrade to 5.15.0-1101.107
|
| Ubuntu:22.04:LTS | canonical | linux-gkeop |
< 5.15.0-1088.96 Fix: upgrade to 5.15.0-1088.96
|
| Ubuntu:22.04:LTS | canonical | linux-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-ibm |
< 5.15.0-1099.102 Fix: upgrade to 5.15.0-1099.102
|
| Ubuntu:22.04:LTS | canonical | linux-ibm-6.8 |
< 6.8.0-1055.56~22.04.1 Fix: upgrade to 6.8.0-1055.56~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iotg |
< 5.15.0-1100.106 Fix: upgrade to 5.15.0-1100.106
|
| Ubuntu:22.04:LTS | canonical | linux-kvm |
< 5.15.0-1097.102 Fix: upgrade to 5.15.0-1097.102
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency |
< 5.15.0-175.185 Fix: upgrade to 5.15.0-175.185
|
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-lowlatency-hwe-6.8 |
< 6.8.0-117.117.1~22.04.1 Fix: upgrade to 6.8.0-117.117.1~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia |
< 5.15.0-1100.101 Fix: upgrade to 5.15.0-1100.101
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra |
< 5.15.0-1057.57 Fix: upgrade to 5.15.0-1057.57
|
| Ubuntu:22.04:LTS | canonical | linux-nvidia-tegra-igx |
< 5.15.0-1046.46 Fix: upgrade to 5.15.0-1046.46
|
| Ubuntu:22.04:LTS | canonical | linux-oem-5.17 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.0 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.1 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oem-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-oracle |
< 5.15.0-1102.108 Fix: upgrade to 5.15.0-1102.108
|
| Ubuntu:22.04:LTS | canonical | linux-oracle-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-raspi |
< 5.15.0-1099.102 Fix: upgrade to 5.15.0-1099.102
|
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv-6.8 |
< 6.8.0-117.117~22.04.1 Fix: upgrade to 6.8.0-117.117~22.04.1
|
| Ubuntu:22.04:LTS | canonical | linux-starfive-5.19 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.2 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-starfive-6.5 | All versions |
| Ubuntu:22.04:LTS | canonical | linux-xilinx-zynqmp |
< 5.15.0-1070.74 Fix: upgrade to 5.15.0-1070.74
|
| Ubuntu:Nvidia-BlueField:22.04:LTS | canonical | linux-bluefield |
< 5.15.0-1089.91 Fix: upgrade to 5.15.0-1089.91
|
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-aws-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-azure-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-fips | All versions |
| Ubuntu:Pro:FIPS-preview:22.04:LTS | canonical | linux-gcp-fips | All versions |
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-aws-fips |
< 5.15.0-1105.112+fips1 Fix: upgrade to 5.15.0-1105.112+fips1
|
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-azure-fips |
< 5.15.0-1110.119+fips1 Fix: upgrade to 5.15.0-1110.119+fips1
|
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-fips |
< 5.15.0-176.186+fips1 Fix: upgrade to 5.15.0-176.186+fips1
|
| Ubuntu:Pro:FIPS-updates:22.04:LTS | canonical | linux-gcp-fips |
< 5.15.0-1105.114+fips1 Fix: upgrade to 5.15.0-1105.114+fips1
|
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-intel-iot-realtime |
< 5.15.0-1097.99 Fix: upgrade to 5.15.0-1097.99
|
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime |
< 5.15.0-1104.113 Fix: upgrade to 5.15.0-1104.113
|
| Ubuntu:Pro:Realtime:22.04:LTS | canonical | linux-realtime-6.8 |
< 6.8.1-1051.52~22.04.1 Fix: upgrade to 6.8.1-1051.52~22.04.1
|
| Ubuntu:24.04:LTS | canonical | linux |
< 6.8.0-117.117 Fix: upgrade to 6.8.0-117.117
|
| Ubuntu:24.04:LTS | canonical | linux-aws |
< 6.8.0-1055.58 Fix: upgrade to 6.8.0-1055.58
|
| Ubuntu:24.04:LTS | canonical | linux-aws-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde |
< 6.8.0-1058.65 Fix: upgrade to 6.8.0-1058.65
|
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-fde-6.17 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-nvidia-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp |
< 6.8.0-1058.61 Fix: upgrade to 6.8.0-1058.61
|
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gke |
< 6.8.0-1054.60 Fix: upgrade to 6.8.0-1054.60
|
| Ubuntu:24.04:LTS | canonical | linux-gkeop |
< 6.8.0-1041.44 Fix: upgrade to 6.8.0-1041.44
|
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-ibm |
< 6.8.0-1055.56 Fix: upgrade to 6.8.0-1055.56
|
| Ubuntu:24.04:LTS | canonical | linux-intel | All versions |
| Ubuntu:24.04:LTS | canonical | linux-lowlatency |
< 6.8.0-117.117.1 Fix: upgrade to 6.8.0-117.117.1
|
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia |
< 6.8.0-1054.57 Fix: upgrade to 6.8.0-1054.57
|
| Ubuntu:24.04:LTS | canonical | linux-nvidia-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-nvidia-lowlatency |
< 6.8.0-1054.57.1 Fix: upgrade to 6.8.0-1054.57.1
|
| Ubuntu:24.04:LTS | canonical | linux-oem-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oem-6.8 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-oracle-6.14 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi |
< 6.8.0-1056.60 Fix: upgrade to 6.8.0-1056.60
|
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv-6.14 | All versions |
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-aws-fips |
< 6.8.0-1055.58+fips1 Fix: upgrade to 6.8.0-1055.58+fips1
|
| Ubuntu:Pro:FIPS-updates:24.04:LTS | canonical | linux-gcp-fips |
< 6.8.0-1058.61+fips1 Fix: upgrade to 6.8.0-1058.61+fips1
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-raspi-realtime |
< 6.8.0-2045.46 Fix: upgrade to 6.8.0-2045.46
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime |
< 6.8.1-1051.52 Fix: upgrade to 6.8.1-1051.52
|
| Ubuntu:Pro:Realtime:24.04:LTS | canonical | linux-realtime-6.14 | All versions |
| Ubuntu:25.10 | canonical | linux-azure-fde | All versions |
| Root:Debian:11 | debian | rootio-linux |
< 5.10.249-1.root.io.52 Fix: upgrade to 5.10.249-1.root.io.52
|
| Root:Debian:13 | debian | linux |
< 6.12.101-1.aikido.158 Fix: upgrade to 6.12.101-1.aikido.158
|
| Root:Ubuntu:22.04 | canonical | linux |
< 5.15.0-187.197.aikido.112 Fix: upgrade to 5.15.0-187.197.aikido.112
|
| Root:Ubuntu:22.04 | canonical | rootio-linux |
< 5.15.0-187.197.aikido.112 Fix: upgrade to 5.15.0-187.197.aikido.112
|
| Root:Ubuntu:24.04 | canonical | linux |
< 6.8.0-138.138.aikido.87 Fix: upgrade to 6.8.0-138.138.aikido.87
|
| Root:Ubuntu:24.04 | canonical | rootio-linux |
< 6.8.0-138.138.aikido.87 Fix: upgrade to 6.8.0-138.138.aikido.87
|
| Linux | linux | kernel |
>= 6.13.0, < 6.16.1 Fix: upgrade to 6.16.1
|
| Root:Ubuntu:24.04 | – | linux |
< 6.8.0-146.146.aikido.89 < 6.8.0-147.147.aikido.90 Fix: upgrade to 6.8.0-146.146.aikido.89
|
| Root:Ubuntu:24.04 | – | rootio-linux |
< 6.8.0-146.146.aikido.89 < 6.8.0-147.147.aikido.90 Fix: upgrade to 6.8.0-146.146.aikido.89
|
| Root:Ubuntu:22.04 | – | linux |
< 5.15.0-198.208.aikido.116 < 5.15.0-202.212.aikido.118 Fix: upgrade to 5.15.0-198.208.aikido.116
|
| Root:Ubuntu:22.04 | – | rootio-linux |
< 5.15.0-198.208.aikido.116 < 5.15.0-202.212.aikido.118 Fix: upgrade to 5.15.0-198.208.aikido.116
|
| Debian:12 | debian | linux |
< 6.1.162-1 Fix: upgrade to 6.1.162-1
|
| Debian:13 | debian | linux |
< 6.12.69-1 Fix: upgrade to 6.12.69-1
|
| Debian:14 | debian | linux |
< 6.16.3-1 Fix: upgrade to 6.16.3-1
|
| Root:Debian:13 | – | linux |
< 6.12.113-1.aikido.163 Fix: upgrade to 6.12.113-1.aikido.163
|
| Root:Debian:13 | – | rootio-linux |
< 6.12.113-1.aikido.163 Fix: upgrade to 6.12.113-1.aikido.163
|
| Root:Debian:12 | – | linux |
< 6.1.190-1.aikido.167 Fix: upgrade to 6.1.190-1.aikido.167
|
| Root:Debian:12 | – | rootio-linux |
< 6.1.190-1.aikido.167 Fix: upgrade to 6.1.190-1.aikido.167
|
Original advisory text
CVE-2025-38591 in linux - Patched by Root
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning: verifier bug: error during ctx access conversion(1) This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction. The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency. Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
References
- https://git.kernel.org/stable/c/058a0da4f6d916a79b693384111bb80a90d73763 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38591... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-38591 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html URL
- https://git.kernel.org/stable/c/33660d44e789edb4f303210c813fc56d56377a90 URL
- https://git.kernel.org/stable/c/7847c4140e06f6e87229faae22cc38525334c156 URL
- https://git.kernel.org/stable/c/feae34c992eb7191862fb1594c704fbbf650fef8 URL
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html URL
- https://security-tracker.debian.org/tracker/CVE-2025-38591 Vendor Advisory
- https://git.kernel.org/stable/c/e2e9599f3503df7cf3569d2b6c50d5488fb59435 URL
- https://ubuntu.com/security/CVE-2025-38591 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-38591 Third Party Advisory
- https://git.kernel.org/linus/e09299225d5ba3916c91ef70565f7d2187e4cca0 Third Party Advisory
- https://git.kernel.org/stable/c/202900ceeef67458c964c2af6e1427c8e533ea7c Third Party Advisory
- https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8162-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8180-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8180-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8186-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8187-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8188-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8180-3 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8180-4 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8180-5 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8243-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8180-6 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8275-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8278-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8289-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8296-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8297-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8296-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8289-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8278-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8393-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8440-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8499-1 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.3
Medium
Timeline
Published19 Aug 2025
Updated3 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-38591 · OSV
CVE-2025-38591 · NVD
CVE-2025-38591 · MITRE
UBUNTU-CVE-2025-38591 · OSV
DEBIAN-CVE-2025-38591 · OSV
Track software like this
Free during beta