CVE-2025-38607

{"id": "CVE-2025-38607", "cveTags": [], "metrics": {}, "published": "2025-08-19T17:15:39.070", "references": [{"url": "https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: handle jset (if a & b ...) as a jump in CFG computation\n\nBPF_JSET is a conditional jump and currently verifier.c:can_jump()\ndoes not know about that. This can lead to incorrect live registers\nand SCC computation.\n\nE.g. in the following example:\n\n 1: r0 = 1;\n 2: r2 = 2;\n 3: if r1 & 0x7 goto +1;\n 4: exit;\n 5: r0 = r2;\n 6: exit;\n\nW/o this fix insn_successors(3) will return only (4), a jump to (5)\nwould be missed and r2 won't be marked as alive at (3)."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: manejar jset (si a & b ...) como un salto en el c\u00e1lculo CFG. BPF_JSET es un salto condicional y actualmente verifier.c:can_jump() no lo detecta. Esto puede provocar registros activos y c\u00e1lculos SCC incorrectos. Por ejemplo, en el siguiente ejemplo: 1: r0 = 1; 2: r2 = 2; 3: si r1 & 0x7 goto +1; 4: salir; 5: r0 = r2; 6: salir; Sin esta correcci\u00f3n, insn_successors(3) solo devolver\u00e1 (4), se omitir\u00eda un salto a (5) y r2 no se marcar\u00eda como activo en (3)."}], "lastModified": "2025-08-20T14:40:17.713", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}