{"answers":{"affected":"It affects 3 products.","exploited":"There is no known exploitation of CVE-2025-38502 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-38502 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 16 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-38502 and fix it if it is affected.\n\nWhat it is: CVE-2025-38502 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 16 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-38502 in the wild and no public exploit code.\n\nAffected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-38502/ (Markdown: https://insights.sbomify.com/CVE-2025-38502/index.md)","id":"CVE-2025-38502","markdown":"https://insights.sbomify.com/CVE-2025-38502/index.md","name":"CVE-2025-38502","record":{"aliases":["AZL-66359","AZL-73473","BELL-CVE-2025-38502","DEBIAN-CVE-2025-38502","GHSA-x96j-4m6x-jcvx","ROOT-OS-DEBIAN-11-CVE-2025-38502","ROOT-OS-DEBIAN-12-CVE-2025-38502","ROOT-OS-DEBIAN-13-CVE-2025-38502","ROOT-OS-UBUNTU-2204-CVE-2025-38502","ROOT-OS-UBUNTU-2404-CVE-2025-38502","UBUNTU-CVE-2025-38502"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An out-of-bounds access in Linux kernel cgroup local storage via tail calls allows attackers to potentially execute code or escalate privileges.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"linux_kernel","vendor":"linux"},{"product":"simatic_cn_4100_firmware","vendor":"siemens"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-125","name":"Out-of-bounds Read"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix oob access in cgroup local storage\n\nLonial reported that an out-of-bounds access in cgroup local storage\ncan be crafted via tail calls. Given two programs each utilizing a\ncgroup local storage with a different value size, and one program\ndoing a tail call into the other. The verifier will validate each of\nthe indivial programs just fine. However, in the runtime context\nthe bpf_cg_run_ctx holds an bpf_prog_array_item which contains the\nBPF program as well as any cgroup local storage flavor the program\nuses. Helpers such as bpf_get_local_storage() pick this up from the\nruntime context:\n\n  ctx = container_of(current-\u003ebpf_ctx, struct bpf_cg_run_ctx, run_ctx);\n  storage = ctx-\u003eprog_item-\u003ecgroup_storage[stype];\n\n  if (stype == BPF_CGROUP_STORAGE_SHARED)\n    ptr = \u0026READ_ONCE(storage-\u003ebuf)-\u003edata[0];\n  else\n    ptr = this_cpu_ptr(storage-\u003epercpu_buf);\n\nFor the second program which was called from the originally attached\none, this means bpf_get_local_storage() will pick up the former\nprogram's map, not its own. With mismatching sizes, this can result\nin an unintended out-of-bounds access.\n\nTo fix this issue, we need to extend bpf_map_owner with an array of\nstorage_cookie[] to match on i) the exact maps from the original\nprogram if the second program was using bpf_get_local_storage(), or\nii) allow the tail call combination if the second program was not\nusing any of the cgroup local storage maps.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-09-11","github_poc":1,"max_poc_stars":2,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-09-11T18:56:40Z","kind":"github_poc","ref":"https://github.com/abraxas/CVE-2025-38502-Linux-LPE","stars":2,"title":"CVE-2025-38502 Linux LPE. BPF cgroup local storage OOB via tail calls. Affected kernels: 5.9–5.15.191, 5.16–6.1.150, 6.2–6.6.104, 6.7–6.12.45, 6.13–6.16.0; fixed in 5.15.192, 6.1.151, 6.6.105, 6.12.46, 6.16.1, 6.17-rc1"}],"tier":"poc_unverified"},"has_fix":true,"headline":"bpf: Fix oob access in cgroup local storage","id":"CVE-2025-38502","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"debian:debian_linux","products":["debian:debian_linux","linux:linux_kernel"],"type":"memory_corruption","year":"2025"},"n_packages":0,"n_references":6,"next":{"headline":"btrfs: fix assertion when building free space tree","id":"CVE-2025-38503"},"packages":[],"prev":{"headline":"ksmbd: limit repeated connections from clients with the same IP","id":"CVE-2025-38501"},"products":["Linux"],"published":"2025-08-16","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"An out-of-bounds access in Linux kernel cgroup local storage via tail calls allows attackers to potentially execute code or escalate privileges.","url":"https://insights.sbomify.com/CVE-2025-38502/"}