Security readout for executives and security teams
Plain-English summary
A Linux eBPF safety-checking flaw can allow an unsafe program to pass verification. Exploitation requires local, low-privileged access according to the CVSS vector; it is not directly remote. Successful abuse could seriously affect system confidentiality, integrity, and availability, but the supplied sources do not demonstrate exploitation.
Executive priority
Treat this as an accelerated patching item, prioritizing shared Linux systems where less-trusted local users may access eBPF capabilities. It is high severity but not evidenced as actively exploited or remotely reachable. Require distribution confirmation because the supplied version mapping is incomplete and inconsistent.
Technical view
copy_verifier_state() failed to copy bpf_verifier_state.loop_entry, allowing values from unrelated states to contaminate env->cur_state. This state-tracking error could cause the eBPF verifier to accept an unsafe program. The referenced Linux stable commits correct the verifier logic; the bundle does not establish the subsequent exploitation mechanism.
Likely exposure
Exposure is limited to Linux kernels containing the vulnerable verifier code and users able to reach the affected eBPF path. The bundle names 6.7, 6.12.31, 6.14.9, and 6.15 as affected, but its version data is inconsistent. Confirm distribution backports rather than relying solely on version strings.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public working exploit. The CVSS vector indicates a local attacker with low privileges, low attack complexity, and no user interaction. Actual reachability depends on whether the attacker can submit programs to the vulnerable eBPF verifier.
Researcher notes
The fix copies loop_entry during verifier-state cloning and expects loop_entry to be null after pop_stack(). The source reports substantial verification-performance regressions for some sched_ext programs and describes follow-on scalability changes. Exact affected and fixed release boundaries, exploit reliability, and post-verifier primitives are not established by the supplied bundle.
Mitigation direction
- Obtain a distribution-supported kernel containing the referenced Linux stable fix or an equivalent backport.
- Apply the approved kernel update using the distribution's documented process.
- Reboot affected systems so they run the corrected kernel.
- Consult Linux and distribution advisories for temporary controls if immediate updating is impossible.
Validation and detection
- Inventory running kernels and identify systems matching the vendor's affected release or package guidance.
- Confirm the installed kernel package contains one referenced fix or a documented equivalent backport.
- Verify the corrected kernel is running after reboot, not merely installed.
- Use vendor-supported verifier regression tests where available and monitor for operational performance changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38060 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78CVE reference, Linux
- https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1CVE reference, Linux
- https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.