Riskcovery

CVE-2025-39990

bpf: Check the helper function is valid in get_helper_proto

State
Published
Severity
7.8 High
Published
Oct 15, 2025
Updated
Oct 21, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the helper function is valid in get_helper_proto

kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design.

[1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f470378c7562a2818b45ed11c98973f2b89eedd3 to before dfbff47f120e4b0793ca0e0b8660361ccac25a74Affected
  • f470378c7562a2818b45ed11c98973f2b89eedd3 to before 3d429cb1278e995e22995ef117fa96d223a67e93Affected
  • f470378c7562a2818b45ed11c98973f2b89eedd3 to before 6233715b4b714068d6c831d214a4e8792109875aAffected
  • f470378c7562a2818b45ed11c98973f2b89eedd3 to before e4414b01c1cd9887bbde92f946c1ba94e40d6d64Affected
LinuxLinux
  • 5.8Affected
  • before 5.8Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.50 through 6.12.*Not affected
  • 6.16.10 through 6.16.*Not affected
  • 6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.