LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38012: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator

In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpf_for_each() macro ignores error returns from new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized state after an error return causing bpf_iter_scx_dsq_next() to dereference garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that next() and destroy() become noops.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can leave a scheduler-related BPF iterator uninitialized after setup fails. Later iterator operations may follow garbage data inside the kernel. Exploitation requires local, low-privilege access according to CVSS, but successful abuse could seriously affect confidentiality, integrity, and availability. It is not described as a remote attack.

Executive priority

Treat this as a high-priority kernel update for systems permitting untrusted local users or relevant BPF activity. It is less urgent than a remotely exploitable flaw, but its stated impact is broad. Prioritize shared and security-sensitive Linux hosts, then verify vendor backports rather than relying only on upstream version numbers.

Technical view

bpf_iter_scx_dsq_new() could return an error without initializing the iterator. Because BPF callers may still invoke next() or destroy(), bpf_iter_scx_dsq_next() could dereference garbage data. The kernel fix always clears kit->dsq, making later operations harmless no-ops after initialization errors.

Likely exposure

The supplied version data lists 6.12, 0, 6.12.30, 6.14.8, and 6.15 under affected status, making the exact range ambiguous. Exposure is most likely where affected kernels let a local low-privileged actor reach the sched_ext BPF iterator path. Distribution backports can change status, so package-level confirmation is required.

Exploitation context

The bundle reports KEV false and provides no cited evidence of active exploitation or a public exploit. CVSS 3.1 scores it 7.8, with a local vector, low complexity, low privileges, and no user interaction. The practical outcome beyond a garbage-data kernel dereference is not established by the supplied sources.

Researcher notes

The corrective behavior is narrowly described: initialize kit->dsq to a cleared state so next() and destroy() become no-ops after errors. No CWE is supplied. Exact vulnerable branch boundaries and real-world exploitability cannot be reconstructed from this bundle alone; map the cited commits against distribution kernel ancestry.

Mitigation direction

  • Upgrade to a distribution-supported kernel containing the applicable upstream stable fix.
  • Confirm the vendor backport includes a cited fixing commit or explicitly addresses CVE-2025-38012.
  • If no fixed package exists, follow vendor guidance; the supplied sources name no separate workaround.

Validation and detection

  • Record the running kernel version and distribution package release on each potentially exposed host.
  • Check vendor changelogs or advisories for CVE-2025-38012 and the cited stable commits.
  • Review whether local low-privileged users can reach relevant BPF and sched_ext functionality.
  • After updating and rebooting, verify that the remediated kernel package is active.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38012 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38012Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux650ba21b131ed1f8ee57826b2c6295a3be221132, 650ba21b131ed1f8ee57826b2c6295a3be221132, 650ba21b131ed1f8ee57826b2c6295a3be221132unaffected
LinuxLinux6.12, 0, 6.12.30, 6.14.8, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.