Kernel Crash Risk in Linux Package Due to BPF Exception Boundary Misconfiguration
Summary
DEBIAN-CVE-2025-38586: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_cal... Affects linux versions < 6.12.43-1. Fixed in 6.12.43-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing the essential kernel that manages system resources and hardware interactions. It is widely used across various distributions for its stability and performance. However, vulnerabilities in the Linux kernel can lead to severe system instability and security risks, making timely updates crucial for maintaining system integrity.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the ARM64 BPF JIT related to the handling of exception boundaries in BPF programs. When the exception boundary is set, the function find_used_callee_regs() is not invoked, leading to a situation where the frame pointer (FP) is not properly initialized. This oversight can result in kernel crashes due to page faults when the FP is utilized in such programs. The vulnerability stems from the incorrect assumption that all callee saved registers are managed appropriately, which is not the case for exception boundary programs.
How To Fix
Minimum fixed version
6.12.43-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The vulnerability identified in the Linux kernel regarding BPF exception boundaries poses a significant risk of kernel crashes. It is crucial for users to update their systems to the patched versions to mitigate this risk. Regular monitoring and updates are essential for maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to kernel crashes, resulting in system instability and potential data loss.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring code access. Visit Vulert Scanner to check your application.
The affected versions are prior to 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14.
Yes, if the kernel crashes due to this vulnerability, it may lead to data loss or corruption.
It is recommended to regularly check for updates and apply them promptly to ensure system security and stability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
