CVE-2025-39990 bpf: Check the helper function is valid in get_helper_proto
A null pointer dereference in the Linux kernel BPF verifier can cause a system crash when specific configuration options are disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39990?
CVE-2025-39990 is a high-severity vulnerability in Linux, published on 15 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check the helper function is valid in get_helper_proto
kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option.
As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design.
[1] https://lore.kernel.org/oe-lkp/[email protected]
Which versions are affected by CVE-2025-39990?
How do I fix CVE-2025-39990?
Apply the vendor's patch.
Is CVE-2025-39990 being exploited?
There is no known exploitation of CVE-2025-39990 in the wild and no public exploit code.
Sources
Also known as AZL-68519, BELL-CVE-2025-39990, DEBIAN-CVE-2025-39990, GHSA-2m9q-5w5g-jwfp, ROOT-OS-DEBIAN-11-CVE-2025-39990, ROOT-OS-DEBIAN-12-CVE-2025-39990 and 4 more.