Security readout for executives and security teams
Plain-English summary
A locally authenticated user able to load relevant BPF programs could submit malformed formatting that the kernel mishandles, producing a kernel warning and reported confidentiality and availability risk. This is not described as remotely exploitable. The correction rejects the malformed input before it reaches runtime formatting.
Executive priority
Prioritize highly on multi-user hosts, developer platforms, and compute services where less-trusted users can access BPF. Schedule an urgent kernel update and reboot. Priority may be lower on tightly controlled single-purpose systems after validating access and affected builds. No active exploitation is established by the supplied evidence.
Technical view
bpf_bprintf_prepare incorrectly skipped the second percent character after %p as punctuation, allowing a malformed format to reach format_decode and trigger a kernel warning. The fix processes that character and rejects the invalid sequence. CVSS is 7.1 with local, low-privileged access; the disclosed example demonstrates a warning, not the full scored impact.
Likely exposure
Exposure concerns Linux systems on affected kernel lines where a low-privileged local user can reach the relevant BPF helpers. The bundle lists affected version values from 5.13 through 6.16, but its flattened data cannot establish exact vulnerable distribution builds. Vendor backports and running kernels require verification.
Exploitation context
The bundle marks this CVE as absent from KEV. No supplied source claims active exploitation or public weaponization. The disclosed trigger is a malformed BPF format string that reaches runtime and produces a kernel warning. The CVSS vector requires local, low-privileged access; practical disclosure or crash reliability is not demonstrated.
Researcher notes
The bundle provides no CWE, exploit report, or outcome beyond the runtime warning. Although CVSS assigns high confidentiality and availability impacts, the supplied description does not demonstrate those consequences. Six stable-kernel fix commits and a Debian LTS advisory are referenced. Determine exposure using distribution backport records rather than kernel version strings alone.
Mitigation direction
- Install the vendor-supplied kernel update containing the applicable stable fix, then reboot into it.
- Use distribution advisories and package changelogs to identify the backported fixed build.
- If updating is delayed, seek vendor-approved workarounds; the supplied sources name none.
- Reduce untrusted local access and BPF-loading permission where operationally feasible until patched.
Validation and detection
- Inventory running kernel and distribution package versions on systems that permit BPF use.
- Match vendor changelogs or backports to CVE-2025-38528 and the cited stable fix commits.
- Verify each system booted the corrected kernel after installation.
- Review kernel logs for the described unsupported-format warning; absence alone does not prove safety.
- Confirm less-trusted local users cannot load relevant BPF programs where policy forbids it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38528 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/97303e541e12f1fea97834ec64b98991e8775f39CVE reference, Linux
- https://git.kernel.org/stable/c/61d5fa45ed13e42af14c7e959baba9908b8ee6d4CVE reference, Linux
- https://git.kernel.org/stable/c/e7be679124bae8cf4fa6e40d7e1661baddfb3289CVE reference, Linux
- https://git.kernel.org/stable/c/6952aeace93f8c9ea01849efecac24dd3152c9c9CVE reference, Linux
- https://git.kernel.org/stable/c/1c5f5fd47bbda17cb885fe6f03730702cd53d3f8CVE reference, Linux
- https://git.kernel.org/stable/c/f8242745871f81a3ac37f9f51853d12854fd0b58CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.