Critical Array Bounds Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2025-22087: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds wh... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its stability, performance, and security features. However, like any complex software, it can be susceptible to vulnerabilities that may compromise system integrity. This specific vulnerability affects the Linux kernel versions in Debian 13 and 14, highlighting the importance of maintaining up-to-date software to mitigate risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the BPF (Berkeley Packet Filter) functionality. The issue arises from an array bounds error in the may_goto function, which uses an additional 8 bytes on the stack. This can lead to out-of-bounds access in the interpreters array when the index is calculated based on the stack size. If exploited, this vulnerability could allow unauthorized access or manipulation of kernel memory, potentially leading to system crashes or security breaches.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading BPF programs directly in non-JIT cases until the kernel is updated. This may help mitigate the risk of exploitation until a patch is applied.
Conclusion
The identified vulnerability in the Linux kernel poses significant risks, but it can be effectively mitigated by updating to the latest patched version. Users are encouraged to regularly check for updates and utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to out-of-bounds memory access, which may allow attackers to manipulate kernel memory, potentially leading to system crashes or unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
As a temporary measure, avoid loading BPF programs directly in non-JIT cases until you can apply the patch.
Detailed information can be found in the Debian CVE database or by visiting the official Linux kernel documentation.
Yes, you can use Vulert's playground to check if your application is affected by this vulnerability without needing to write any code or sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
