CVE-2025-38591 bpf: Reject narrower access to pointer ctx fields
A flaw in the Linux kernel BPF verifier allows a kernel warning and potential crash when accessing pointer context fields with narrower sizes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38591?
CVE-2025-38591 is a medium-severity denial of service vulnerability in Linux kernel, published on 19 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject narrower access to pointer ctx fields
The following BPF program, simplified from a syzkaller repro, causes a kernel warning:
r0 = *(u8 *)(r1 + 169); exit;
With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning:
verifier bug: error during ctx access conversion(1)
This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction.
The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency.
Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list.
Which versions are affected by CVE-2025-38591?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38591?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-38591 being exploited?
There is no known exploitation of CVE-2025-38591 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-66440, AZL-71033, BELL-CVE-2025-38591, DEBIAN-CVE-2025-38591, GHSA-cgjw-h652-c9q2, ROOT-OS-DEBIAN-11-CVE-2025-38591 and 5 more.