Critical Vulnerability in Linux Kernel: Loop Entry State Copying Issue
Summary
DEBIAN-CVE-2025-38060: In the Linux kernel, the following vulnerability has been resolved: bpf: copy_verifier_state() should copy 'loop_entry' field The bpf_verifier_state.loop_entry state should be copied by copy_verifier_state(). Affects linux versions < 6.12.32-1. Fixed in 6.12.32-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. The vulnerability in question affects the kernel's BPF (Berkeley Packet Filter) verifier, which is crucial for ensuring the safety and correctness of BPF programs. This vulnerability could lead to unexpected behavior in the kernel, potentially compromising system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the BPF verifier where the 'loop_entry' field is not copied correctly by the 'copy_verifier_state()' function. This oversight can lead to the poisoning of the current state with values from unrelated states, resulting in incorrect behavior during program verification. The vulnerability can impact verification performance and may allow unsafe programs to be accepted by the verifier, posing a risk to system stability and security.
How To Fix
Minimum fixed version
6.12.32-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The vulnerability in the Linux kernel's BPF verifier poses a significant risk by allowing unsafe programs to be accepted, potentially compromising system integrity. It is crucial for users to update to the patched version to ensure their systems remain secure.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper copying of the 'loop_entry' field in the BPF verifier, which can lead to incorrect program verification.
The vulnerability can negatively impact verification performance for BPF selftests and may allow unsafe programs to be accepted, affecting system stability.
Yes, a patch is available in version 6.12.32-1 of the Linux kernel for both Debian 13 and 14.
While no specific workarounds are available, it is recommended to monitor the situation and apply the patch as soon as possible to mitigate risks.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
