CVE-2025-38280: Linux Kernel Privilege Escalation Flaw

CVE-2025-38280 Overview

CVE-2025-38280 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw resides in kernel/bpf/core.c and involves incorrect handling of BPF programs when Just-In-Time (JIT) compilation fails. When CONFIG_BPF_JIT_ALWAYS_ON is not set and bpf_jit_enable is set to 1, a failed JIT compilation still marks the program as valid. Executing the program subsequently invokes __bpf_prog_ret0_warn and triggers WARN_ON_ONCE(1). The issue was originally reported by syzkaller and affects multiple upstream Linux kernel branches along with Debian Linux 11.

Critical Impact
A local low-privileged user can trigger kernel warnings and unpredictable BPF program behavior, undermining the integrity and availability of the host.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian Linux 11
Siemens industrial products referenced in advisory SSA-082556

Discovery Timeline

2025-07-10 - CVE-2025-38280 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38280

Vulnerability Analysis

The vulnerability is a kernel logic flaw in the BPF core execution path. When user space loads a BPF program, the kernel sets fp->jit_requested based on the bpf_jit_enable sysctl. If JIT compilation is attempted but fails, for example due to fault injection or memory pressure, the kernel does not correctly reject the program.

Instead, the program is retained with an interpreter entry point that resolves to __bpf_prog_ret0_warn. This stub exists specifically to detect programs that were never properly finalized. When network traffic or another trigger executes the program through bpf_prog_run, the stub fires WARN_ON_ONCE(1) and returns zero.

The kernel warning taints the kernel, floods logs, and can be leveraged by local attackers holding CAP_BPF or equivalent capabilities to induce denial-of-service conditions or interfere with packet classification through cls_bpf.

Root Cause

The root cause is the absence of a validity check after JIT compilation fails on kernels built without CONFIG_BPF_JIT_ALWAYS_ON. The BPF loader treats the program as executable even though no valid image was produced. Fault injection paths in syzkaller exposed the condition by simulating allocation failures during JIT emission.

Attack Vector

Exploitation requires local access with the ability to load BPF programs, which typically means CAP_BPF or CAP_SYS_ADMIN. An attacker crafts or triggers a BPF program load under conditions that cause the architecture-specific JIT backend to fail. The program is then attached to a subsystem such as cls_bpf and executed via network traffic or another trigger, invoking the warning stub inside the kernel.

No public proof-of-concept exploit code is available beyond the syzkaller reproducer described in the upstream commit messages. Refer to the upstream fix commit for the corrected validation logic.

Detection Methods for CVE-2025-38280

Indicators of Compromise

Kernel log entries containing WARNING: CPU: ... __bpf_prog_ret0_warn+0xa/0x20 kernel/bpf/core.c:2357
Call traces referencing bpf_dispatcher_nop_func, __bpf_prog_run, or cls_bpf_classify following BPF program loads
Repeated BPF program load failures accompanied by immediate re-attempts from the same PID or UID

Detection Strategies

Monitor dmesg and journald for __bpf_prog_ret0_warn warnings and kernel taint flag changes
Audit bpf() syscalls using auditd or eBPF-based syscall telemetry to correlate program loads with warning events
Track processes that repeatedly invoke BPF_PROG_LOAD under memory pressure or fault-injection contexts

Monitoring Recommendations

Forward kernel ring buffer and audit logs to a centralized SIEM for correlation and long-term retention
Alert on any kernel taint transitions on production Linux hosts, particularly those running network policy or observability workloads
Baseline normal BPF program load counts per host and alert on statistical deviations

How to Mitigate CVE-2025-38280

Immediate Actions Required

Apply the stable kernel updates referenced in the six upstream commits, including 86bc9c7 and ef92b96
Update Debian 11 systems per the Debian LTS Announcement 2025-10
Review Siemens deployments against Siemens Security Advisory SSA-082556 and apply vendor updates
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted service accounts only

Patch Information

The fix is available across multiple stable branches. Distribution-specific packages are published by Debian and Siemens. Verify the running kernel version after patching with uname -r and confirm the fix commit is included in the changelog. Full commit references are listed in the vendor advisory URLs provided by NVD.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged BPF program loads
Build or select kernels with CONFIG_BPF_JIT_ALWAYS_ON=y, which enforces JIT validity and rejects fallback interpreter execution
Disable the BPF JIT temporarily by setting net.core.bpf_jit_enable=0 where operationally acceptable

bash

# Configuration example
# Disable unprivileged BPF program loads
sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist the setting
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf

# Optionally disable the JIT to sidestep the failure path
sysctl -w net.core.bpf_jit_enable=0