{"cve":{"cve_id":"CVE-2025-38502","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00164,"epss_percentile":0.05998,"epss_as_of":"2026-09-15","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix oob access in cgroup local storage\n\nLonial reported that an out-of-bounds access in cgroup local storage\ncan be crafted via tail calls. Given two programs each utilizing a\ncgroup local storage with a different value size, and one program\ndoing a tail call into the other. The verifier will validate each of\nthe indivial programs just fine. However, in the runtime context\nthe bpf_cg_run_ctx holds an bpf_prog_array_item which contains the\nBPF program as well as any cgroup local storage flavor the program\nuses. Helpers such as bpf_get_local_storage() pick this up from the\nruntime context:\n\n  ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx);\n  storage = ctx->prog_item->cgroup_storage[stype];\n\n  if (stype == BPF_CGROUP_STORAGE_SHARED)\n    ptr = &READ_ONCE(storage->buf)->data[0];\n  else\n    ptr = this_cpu_ptr(storage->percpu_buf);\n\nFor the second program which was called from the originally attached\none, this means bpf_get_local_storage() will pick up the former\nprogram's map, not its own. With mismatching sizes, this can result\nin an unintended out-of-bounds access.\n\nTo fix this issue, we need to extend bpf_map_owner with an array of\nstorage_cookie[] to match on i) the exact maps from the original\nprogram if the second program was using bpf_get_local_storage(), or\nii) allow the tail call combination if the second program was not\nusing any of the cgroup local storage maps.","published_at":"2025-08-16T09:34:25.135000Z","last_modified_at":"2026-07-30T06:23:22.870000Z","cvss_v3_score":7.8,"cvss_v3_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_v3_severity":"HIGH","cvss_v4_score":null,"cvss_v4_vector":null,"cvss_v4_severity":null,"ssvc_decision":null,"ssvc_exploitation":null,"ssvc_automatable":null,"ssvc_technical_impact":null,"cwes":["CWE-125"],"nvd_references":["https://git.kernel.org/stable/c/c1c74584b9b4043c52e41fec415226e582d266a3","https://git.kernel.org/stable/c/66da7cee78590259b400e51a70622ccd41da7bb2","https://git.kernel.org/stable/c/7acfa07c585e3d7a64654d38f0a5c762877d0b9b","https://git.kernel.org/stable/c/41688d1fc5d163a6c2c0e95c0419e2cb31a44648","https://git.kernel.org/stable/c/19341d5c59e8c7e8528e40f8663e99d67810473c","https://git.kernel.org/stable/c/abad3d0bad72a52137e0c350c59542d75ae4f513"],"vuln_status":"Modified","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:39.878444Z","updated_at":"2026-07-31T14:19:43.412296Z"},"effective_severity":"HIGH","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"L","value_label":"Local"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"L","value_label":"Low"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"H","value_label":"High"},{"metric":"I","name":"Integrity","value":"H","value_label":"High"},{"metric":"A","name":"Availability","value":"H","value_label":"High"}]},"cvss_v4_decoded":{"version":null,"metrics":[]},"affected":[{"vendor_slug":"debian","vendor_name":"Debian","product_slug":"debian-linux","product_name":"debian_linux","version_start":"11.0","version_start_inclusive":true,"version_end":"11.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"7d9c3427894fe70d1347b4820476bf37736d2ff0","version_start_inclusive":true,"version_end":"66da7cee78590259b400e51a70622ccd41da7bb2","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:7d9c3427894fe70d1347b4820476bf37736d2ff0:66da7cee78590259b400e51a70622ccd41da7bb2"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"7d9c3427894fe70d1347b4820476bf37736d2ff0","version_start_inclusive":true,"version_end":"7acfa07c585e3d7a64654d38f0a5c762877d0b9b","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:7d9c3427894fe70d1347b4820476bf37736d2ff0:7acfa07c585e3d7a64654d38f0a5c762877d0b9b"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"7d9c3427894fe70d1347b4820476bf37736d2ff0","version_start_inclusive":true,"version_end":"41688d1fc5d163a6c2c0e95c0419e2cb31a44648","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:7d9c3427894fe70d1347b4820476bf37736d2ff0:41688d1fc5d163a6c2c0e95c0419e2cb31a44648"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"7d9c3427894fe70d1347b4820476bf37736d2ff0","version_start_inclusive":true,"version_end":"19341d5c59e8c7e8528e40f8663e99d67810473c","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:7d9c3427894fe70d1347b4820476bf37736d2ff0:19341d5c59e8c7e8528e40f8663e99d67810473c"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"7d9c3427894fe70d1347b4820476bf37736d2ff0","version_start_inclusive":true,"version_end":"abad3d0bad72a52137e0c350c59542d75ae4f513","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:7d9c3427894fe70d1347b4820476bf37736d2ff0:abad3d0bad72a52137e0c350c59542d75ae4f513"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"5.9","version_start_inclusive":true,"version_end":"5.9","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:5.9:5.9"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"0","version_start_inclusive":true,"version_end":"5.9","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:0:5.9"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"5.15.192","version_start_inclusive":true,"version_end":"5.15.*","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:5.15.192:5.15.*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"6.1.151","version_start_inclusive":true,"version_end":"6.1.*","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:6.1.151:6.1.*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"6.6.105","version_start_inclusive":true,"version_end":"6.6.*","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:6.6.105:6.6.*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"6.12.46","version_start_inclusive":true,"version_end":"6.12.*","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:6.12.46:6.12.*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"6.16.1","version_start_inclusive":true,"version_end":"6.16.*","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:6.16.1:6.16.*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"6.17","version_start_inclusive":true,"version_end":"*","version_end_inclusive":true,"cpe23_uri":"cve5:linux:linux:6.17:*"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux","product_name":"Linux","version_start":"7d9c3427894fe70d1347b4820476bf37736d2ff0","version_start_inclusive":true,"version_end":"c1c74584b9b4043c52e41fec415226e582d266a3","version_end_inclusive":false,"cpe23_uri":"cve5:linux:linux:7d9c3427894fe70d1347b4820476bf37736d2ff0:c1c74584b9b4043c52e41fec415226e582d266a3"},{"vendor_slug":"linux","vendor_name":"Linux","product_slug":"linux-kernel","product_name":"Linux kernel","version_start":"5.9","version_start_inclusive":true,"version_end":"5.15.192","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"},{"vendor_slug":"siemens","vendor_name":"Siemens","product_slug":"simatic-cn-4100-firmware","product_name":"simatic_cn_4100_firmware","version_start":null,"version_start_inclusive":null,"version_end":"5.0","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:*"}],"exploit_refs":[],"news":[],"references":[{"url":"https://git.kernel.org/stable/c/c1c74584b9b4043c52e41fec415226e582d266a3","source_type":"MISC","tags":[]},{"url":"https://git.kernel.org/stable/c/66da7cee78590259b400e51a70622ccd41da7bb2","source_type":"MISC","tags":[]},{"url":"https://git.kernel.org/stable/c/7acfa07c585e3d7a64654d38f0a5c762877d0b9b","source_type":"MISC","tags":[]},{"url":"https://git.kernel.org/stable/c/41688d1fc5d163a6c2c0e95c0419e2cb31a44648","source_type":"MISC","tags":[]},{"url":"https://git.kernel.org/stable/c/19341d5c59e8c7e8528e40f8663e99d67810473c","source_type":"MISC","tags":[]},{"url":"https://git.kernel.org/stable/c/abad3d0bad72a52137e0c350c59542d75ae4f513","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2025-08-16T09:34:25.135000Z","label":"CVE published","source":null},{"type":"cvss_changed","at":"2026-07-30T09:03:23.265941Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-07-30T09:03:23.265941Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-07-30T09:03:23.265941Z","label":"CVSS score revised","source":"cvelistv5"}]}