LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38586: bpf, arm64: Fix fp initialization for exception boundary

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a program acting as exception boundary, all callee saved registers are saved. find_used_callee_regs() sets `ctx->fp_used = true;` when it sees FP being used in any of the instructions. For programs acting as exception boundary, ctx->fp_used remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault. Fix it by setting ctx->fp_used = true for exception boundary programs as fp is always saved in such programs.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux ARM64 BPF just-in-time compiler can leave the frame pointer improperly initialized for certain BPF programs. This may cause a kernel page fault and crash. The issue requires local access according to the supplied CVSS vector and is most relevant to affected ARM64 systems using the applicable BPF functionality.

Executive priority

Treat as a high-priority kernel update for exposed ARM64 fleets, especially multi-user or shared-compute systems permitting BPF activity. Validate applicability promptly and patch through supported distribution channels. Evidence does not currently justify an emergency response based on active exploitation, but a kernel-crash path warrants timely remediation.

Technical view

For BPF programs marked as exception boundaries, the ARM64 JIT skips find_used_callee_regs(), leaving ctx->fp_used false even when the frame pointer is used. Consequently, the prologue does not initialize FP, potentially causing a page fault and kernel crash. The Linux fix explicitly marks FP as used for exception-boundary programs.

Likely exposure

Exposure is limited to ARM64 Linux systems running affected kernel builds where the ARM64 BPF JIT handles exception-boundary programs. The supplied record lists affected 6.12, 6.12.42, 6.15.10, 6.16.1, and 6.17-related versions, but downstream distribution applicability requires vendor confirmation. BPF permissions and workload usage materially affect practical exposure.

Exploitation context

The supplied bundle marks this CVE as absent from CISA KEV, and no cited source reports active exploitation. The CVSS vector indicates a local, low-privilege attack context without user interaction. Public evidence establishes a crash condition but does not establish reliable privilege escalation, code execution, or in-the-wild exploitation.

Researcher notes

The documented root cause is incorrect FP-use tracking, not a conventional memory-corruption primitive. Although the supplied CVSS asserts high confidentiality, integrity, and availability impacts, the description specifically demonstrates a page-fault crash. Exact exploitation consequences, triggering prerequisites, and downstream affected package ranges are not established by the supplied evidence.

Mitigation direction

  • Obtain a supported kernel update that incorporates the referenced Linux stable fix.
  • Check your Linux distributor's guidance for exact affected builds and installation requirements.
  • Prioritize affected ARM64 systems that permit relevant BPF program loading.
  • Follow vendor instructions to activate the updated kernel and confirm the running build.

Validation and detection

  • Inventory ARM64 hosts and record the actively running kernel build.
  • Compare each build with distributor advisories and affected releases in the CVE record.
  • Determine whether the ARM64 BPF JIT and BPF exception-boundary programs are relevant.
  • Verify the running kernel package includes one of the referenced stable fixes.
  • Review kernel logs for page faults or crashes associated with BPF activity.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38586 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-38586Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5d4fa9ec5643a5c75d3c1e6abf50fb9284caf1ff, 5d4fa9ec5643a5c75d3c1e6abf50fb9284caf1ff, 5d4fa9ec5643a5c75d3c1e6abf50fb9284caf1ff, 5d4fa9ec5643a5c75d3c1e6abf50fb9284caf1ffunaffected
LinuxLinux6.12, 0, 6.12.42, 6.15.10, 6.16.1, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.