CVE-2025-38285

Q: What is the severity of CVE-2025-38285?

CVE-2025-38285 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability in the BPF subsystem where nested tracepoint calls trigger a WARN_ON_ONCE warning, potentially causing kernel panic or system instability. This affects systems running vulnerable Linux kernel versions with BPF tracing enabled. The issue was discovered through syzkaller fuzzing.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A Linux kernel vulnerability in the BPF subsystem where nested tracepoint calls trigger a WARN_ON_ONCE warning, potentially causing kernel panic or system instability. This affects systems running vulnerable Linux kernel versions with BPF tracing enabled. The issue was discovered through syzkaller fuzzing.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific versions containing the vulnerable code (exact range depends on kernel distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires BPF tracing functionality and specific tracepoint usage patterns. Not all systems with vulnerable kernels will be exploitable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting critical services.

🟠

Likely Case

System instability or crash when specific BPF programs trigger nested tracepoint calls, primarily affecting debugging/tracing scenarios.

🟢

If Mitigated

Minor performance impact or warning messages in logs if BPF tracing is disabled or limited.

🌐 Internet-Facing: LOW - Requires local access and specific BPF program execution.

🏢 Internal Only: MEDIUM - Local users or processes with CAP_BPF privileges could trigger the issue, potentially causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to load BPF programs (typically requires CAP_BPF or root privileges). Discovered through fuzzing, not known to be actively exploited.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commit 147ea936fc6fa8fe0c93f0df918803a5375ca535 or later

Vendor Advisory: https://git.kernel.org/stable/c/147ea936fc6fa8fe0c93f0df918803a5375ca535

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable BPF tracing

linux

Prevent BPF programs from using raw tracepoints that could trigger the nested call issue

sysctl -w kernel.bpf_disabled=1

Restrict BPF capabilities

linux

Limit which users can load BPF programs using capabilities or namespaces

setcap -r /usr/bin/bpftool
Remove CAP_BPF from non-essential users

🧯 If You Can't Patch

Implement strict BPF program auditing and monitoring
Isolate critical systems and limit BPF usage to trusted processes only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if commit 147ea936fc6fa8fe0c93f0df918803a5375ca535 is missing: uname -r && git log --oneline | grep '147ea936fc6fa8fe0c93f0df918803a5375ca535'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commit: grep -q '147ea936fc6fa8fe0c93f0df918803a5375ca535' /proc/version || echo 'Patched'

📡 Detection & Monitoring

Log Indicators:

Kernel WARN messages about get_bpf_raw_tp_regs
System crashes or instability when BPF tracing is active

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND "WARNING.*get_bpf_raw_tp_regs" OR "kernel panic"

📊 Metadata

CVE ID: CVE-2025-38285

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-617

EPSS Score: 0.03% exploit probability (7.1th percentile)

Published: July 10, 2025

Last Updated: December 18, 2025

🔗 References

https://git.kernel.org/stable/c/147ea936fc6fa8fe0c93f0df918803a5375ca535 Patch
https://git.kernel.org/stable/c/18e8cbbae79cb35bdce8a01c889827b9799c762e Patch
https://git.kernel.org/stable/c/3880cdbed1c4607e378f58fa924c5d6df900d1d3 Patch
https://git.kernel.org/stable/c/44ebe361abb322d2afd77930fa767a99f271c4d1 Patch
https://git.kernel.org/stable/c/6d8f39875a10a194051c3eaefebc7ac06a34aaf3 Patch
https://git.kernel.org/stable/c/c98cdf6795a36bca163ebb40411fef1687b9eb13 Patch
https://git.kernel.org/stable/c/e167414beabb1e941fe563a96becc98627d5bdf6 Patch
https://git.kernel.org/stable/c/ee90be48edb3dac612e0b7f5332482a9e8be2696 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory,Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory,Mailing List

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable BPF tracing

Restrict BPF capabilities

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities