CVE-2025-38586

A flaw of low impact was found in the Linux kernel's ARM64 BPF JIT compiler. When a BPF program is configured as an exception boundary, find_used_callee_regs() is not called and ctx->fp_used remains false, so the frame pointer is not set up in the JIT-generated prologue even when the program uses it. A local attacker able to load a crafted BPF program acting as an exception boundary could exploit this to cause a kernel crash through a page fault, resulting in a denial of service. There is no impact on the confidentiality or integrity of the system.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 1 are affected, and the fix is currently deferred given the low security impact of this local denial-of-service condition; the residual risk is limited to system availability on the affected local host. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases.

Red Hat rates this flaw as Low severity (CVSS 4.4) because triggering it requires high privileges on the affected local system, which is lower than the NIST score of 5.5. The CVE.org score of 7.8, which includes high confidentiality and integrity impacts, is not supported by the technical evidence, which demonstrates only a denial-of-service impact.