Critical BPF Vulnerability in Linux Kernel: CVE-2025-38202
Summary
CVE-2025-38202: In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. Affects linux versions < 6.1.147-1. Fixed in 6.1.147-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports various functionalities, including process management, memory management, and device control. The kernel is modular, allowing for the addition of features through loadable modules. However, vulnerabilities in the kernel can lead to severe security risks, affecting the stability and integrity of the entire system.
Vulnerability Detail
CVE-2025-38202 is a vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It arises from the bpf_map_lookup_percpu_elem() helper, which is available for sleepable BPF programs. When the BPF JIT (Just-In-Time) compiler is disabled or when running on a 32-bit host, this helper will not be inlined, leading to a situation where using it in a sleepable BPF program can trigger warnings. The issue stems from the fact that the BPF program only holds the rcu_read_lock_trace lock, which can lead to unexpected behavior and potential security risks if not properly managed.
How To Fix
Minimum fixed version
6.1.147-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-38202 represents a significant vulnerability in the Linux kernel's BPF subsystem, which can lead to serious security implications if not addressed. Users are strongly advised to update their systems to the latest patched version to ensure their systems remain secure.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38202 is a vulnerability in the Linux kernel's BPF subsystem that can lead to unexpected behavior in sleepable BPF programs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The risks include potential instability and security issues within the Linux kernel, which could lead to system crashes or unauthorized access.
Yes, users should update their Linux kernel to the latest version that includes the fix for CVE-2025-38202.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
