CVE-2025-38640

A low impact denial of service flaw was found in the Linux kernel BPF netfilter hook implementation (nf_hook_run_bpf in net/netfilter/nf_bpf_link.c). When a BPF program attached to a netfilter hook runs in the network transmit path, migration is not disabled, so the non-migratable-context assertion in __bpf_prog_run() fails and the kernel panics. A local attacker with the privileges required to attach a BPF program to a netfilter hook can use this to crash the system, causing a denial of service; the flaw affects availability only and cannot be used to compromise confidentiality or integrity. For this reason the Red Hat severity of Low (CVSS 4.4) differs from the upstream CVEORG rating of Important (7.8), which assumes impact to confidentiality and integrity as well.

The BPF netfilter hook code that contains this flaw is not present in Red Hat Enterprise Linux 6, 7, or 8, so the kernel and kernel-rt packages in those releases are not affected. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 1 (kernel) contain the vulnerable code and are affected; the fix is deferred to a future kernel update because this is a low-impact denial of service that requires highly privileged local access to exploit. The residual risk of deferral is that such a privileged local user could trigger a kernel panic, but cannot gain additional privileges or access or modify data.