CVE-2025-39990

Linux Kernel 5.8-6.12.49, 6.13-6.16.9 - Use-After-Free in BPF Helper Function Validation

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Check the helper function is valid in get_helper_proto kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option. As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design. [1] https://lore.kernel.org/oe-lkp/[email protected]

References (3)

Core 3

Core References

Patch

https://git.kernel.org/stable/c/3d429cb1278e995e22995ef117fa96d223a67e93

Patch

https://git.kernel.org/stable/c/6233715b4b714068d6c831d214a4e8792109875a

Patch

https://git.kernel.org/stable/c/e4414b01c1cd9887bbde92f946c1ba94e40d6d64

Scores

EPSS 0.0018

EPSS Percentile 8.1%

Details

Status published

Products (10)

linux/Kernel 5.8.0 - 6.12.50linux

linux/Kernel 6.13.0 - 6.16.10linux

Linux/Linux < 5.8

Linux/Linux 5.8

Linux/Linux 6.12.50 - 6.12.*

Linux/Linux 6.16.10 - 6.16.*

Linux/Linux 6.17

Linux/Linux f470378c7562a2818b45ed11c98973f2b89eedd3 - 3d429cb1278e995e22995ef117fa96d223a67e93

Linux/Linux f470378c7562a2818b45ed11c98973f2b89eedd3 - 6233715b4b714068d6c831d214a4e8792109875a

Linux/Linux f470378c7562a2818b45ed11c98973f2b89eedd3 - e4414b01c1cd9887bbde92f946c1ba94e40d6d64

Published Oct 15, 2025

Tracked Since Feb 18, 2026