Critical Vulnerability in Linux Kernel: CAP_SYS_ADMIN Requirement for Uprobes
Summary
CVE-2025-38466: In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used destructively when used in the middle of an instruction. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is widely used across various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This vulnerability specifically affects the uprobes feature, which allows users to dynamically insert probes into running applications for debugging and performance analysis.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the uprobes functionality. The issue arises when uprobes are used in the middle of an instruction, which can lead to destructive behavior. The kernel only checks for a valid instruction at the specified offset but cannot determine if it is an instruction as perceived by the execution stream due to variable instruction lengths. Additionally, on architectures like arm64 that mix data in the text segment, data words can be misinterpreted as instructions. This vulnerability requires the CAP_SYS_ADMIN capability to mitigate potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should refrain from using uprobes without the CAP_SYS_ADMIN capability until the system is updated to the patched version. This will help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The CVE-2025-38466 vulnerability in the Linux kernel poses significant risks related to the uprobes feature. It is crucial for users to update their systems to the latest patched version to mitigate these risks. Understanding the nature of this vulnerability and taking appropriate action will help maintain system security.
See every vulnerability recorded for linux →
FAQ
The impact includes potential exploitation of the uprobes feature, leading to destructive behavior in applications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
CAP_SYS_ADMIN is a Linux capability that grants administrative privileges to perform various system-level operations.
Yes, a patch is available. Users should update their Linux packages to the latest version to apply the fix.
If an immediate update is not possible, avoid using uprobes without the CAP_SYS_ADMIN capability as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
