GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38528 (GCVE-0-2025-38528)

Vulnerability from cvelistv5 – Published: 2025-08-16 11:12 – Updated: 2026-08-05 12:02
VLAI
Title
bpf: Reject %p% format string in bprintf-like helpers
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 48cac3f4a96ddf08df8e53809ed066de0dc93915 , < 97303e541e12f1fea97834ec64b98991e8775f39 (git)
Affected: 48cac3f4a96ddf08df8e53809ed066de0dc93915 , < 61d5fa45ed13e42af14c7e959baba9908b8ee6d4 (git)
Affected: 48cac3f4a96ddf08df8e53809ed066de0dc93915 , < e7be679124bae8cf4fa6e40d7e1661baddfb3289 (git)
Affected: 48cac3f4a96ddf08df8e53809ed066de0dc93915 , < 6952aeace93f8c9ea01849efecac24dd3152c9c9 (git)
Affected: 48cac3f4a96ddf08df8e53809ed066de0dc93915 , < 1c5f5fd47bbda17cb885fe6f03730702cd53d3f8 (git)
Affected: 48cac3f4a96ddf08df8e53809ed066de0dc93915 , < f8242745871f81a3ac37f9f51853d12854fd0b58 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.190 , ≤ 5.15.* (semver)
Unaffected: 6.1.147 , ≤ 6.1.* (semver)
Unaffected: 6.6.100 , ≤ 6.6.* (semver)
Unaffected: 6.12.40 , ≤ 6.12.* (semver)
Unaffected: 6.15.8 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:24.864Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97303e541e12f1fea97834ec64b98991e8775f39",
              "status": "affected",
              "version": "48cac3f4a96ddf08df8e53809ed066de0dc93915",
              "versionType": "git"
            },
            {
              "lessThan": "61d5fa45ed13e42af14c7e959baba9908b8ee6d4",
              "status": "affected",
              "version": "48cac3f4a96ddf08df8e53809ed066de0dc93915",
              "versionType": "git"
            },
            {
              "lessThan": "e7be679124bae8cf4fa6e40d7e1661baddfb3289",
              "status": "affected",
              "version": "48cac3f4a96ddf08df8e53809ed066de0dc93915",
              "versionType": "git"
            },
            {
              "lessThan": "6952aeace93f8c9ea01849efecac24dd3152c9c9",
              "status": "affected",
              "version": "48cac3f4a96ddf08df8e53809ed066de0dc93915",
              "versionType": "git"
            },
            {
              "lessThan": "1c5f5fd47bbda17cb885fe6f03730702cd53d3f8",
              "status": "affected",
              "version": "48cac3f4a96ddf08df8e53809ed066de0dc93915",
              "versionType": "git"
            },
            {
              "lessThan": "f8242745871f81a3ac37f9f51853d12854fd0b58",
              "status": "affected",
              "version": "48cac3f4a96ddf08df8e53809ed066de0dc93915",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/helpers.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject %p% format string in bprintf-like helpers\n\nstatic const char fmt[] = \"%p%\";\n    bpf_trace_printk(fmt, sizeof(fmt));\n\nThe above BPF program isn\u0027t rejected and causes a kernel warning at\nruntime:\n\n    Please remove unsupported %\\x00 in format string\n    WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0\n\nThis happens because bpf_bprintf_prepare skips over the second %,\ndetected as punctuation, while processing %p. This patch fixes it by\nnot skipping over punctuation. %\\x00 is then processed in the next\niteration and rejected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only trigger is a locally loaded eBPF program invoking a bprintf-like helper (`bpf_trace_printk`, `bpf_trace_vprintk`, `bpf_snprintf`, `bpf_seq_printf`) via the `bpf()` syscall; the format string is attacker-authored at `BPF_PROG_LOAD` time and consumed in the calling task\u0027s own context. No remote peer or packet can supply a format string.\nAC:L - The attacker fully controls the constant format string, so `\"%p%\"` deterministically reaches the `WARN_ONCE` in `format_decode()` and `\"%p%s\"` deterministically desyncs `bpf_bprintf_prepare()` from `bstr_printf()` on the first call \u2014 no race, no timing window, no dependence on memory layout the attacker cannot influence.\nPR:L - Reaching the helpers requires CAP_BPF plus CAP_PERFMON (or CAP_SYS_ADMIN) rather than full root, and these are routinely granted to non-root eBPF observability/profiling service accounts and can be delegated into a user namespace via a BPF token (supported in all affected 6.9+ branches), so a low-privilege non-root actor suffices.\nUI:N - The attacker performs self-contained `bpf(BPF_PROG_LOAD)` and program-run/attach operations; no victim must mount a filesystem, open a file, or take any other action.\nS:U - The faulty parse, the warning, and the stale-memory read all occur in the kernel\u0027s own security authority within the calling task\u0027s context; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The prepare/print desync makes `bstr_printf()`\u0027s `FORMAT_STATE_STR` `strlen()` and copy uninitialized bytes from the per-CPU `bpf_bprintf_buffers` (512-byte `bin_args` followed by the 1024-byte `buf`, and potentially past the struct into adjacent per-CPU memory) straight into the `bpf_snprintf` output buffer or trace ring buffer that the attacker reads; because `nocopy_fmt` stores raw unhashed 64-bit values there, this leaks unsanitized kernel pointers, on top of the KASLR-defeating backtrace the `WARN_ONCE` dumps to dmesg.\nI:N - All writes stay bounded \u2014 `nocopy_fmt` checks `tmp_buf_end - tmp_buf` before storing, and `bstr_printf()`/`string()` gate every store on `str \u003c end` \u2014 so the bug under-fills the argument buffer rather than overflowing it; no kernel or user memory is modified out of bounds.\nA:H - `\"%p%\"` triggers `WARN_ONCE` at `lib/vsprintf.c:2807`, which becomes a full kernel panic on the widely deployed `panic_on_warn=1` used in hardened cloud, Android, and fuzzing configurations \u2014 exactly the crash syzbot reported \u2014 and the unbounded `strlen()` over per-CPU memory can additionally fault; even without `panic_on_warn` the splat taints the kernel and can trip health-check tooling into taking the node down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:41.331Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97303e541e12f1fea97834ec64b98991e8775f39"
        },
        {
          "url": "https://git.kernel.org/stable/c/61d5fa45ed13e42af14c7e959baba9908b8ee6d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7be679124bae8cf4fa6e40d7e1661baddfb3289"
        },
        {
          "url": "https://git.kernel.org/stable/c/6952aeace93f8c9ea01849efecac24dd3152c9c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c5f5fd47bbda17cb885fe6f03730702cd53d3f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8242745871f81a3ac37f9f51853d12854fd0b58"
        }
      ],
      "title": "bpf: Reject %p% format string in bprintf-like helpers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38528",
    "datePublished": "2025-08-16T11:12:21.667Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-08-05T12:02:41.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38528",
      "date": "2026-09-16",
      "epss": "0.00164",
      "percentile": "0.05967"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:43:11.000Z",
      "cve": "CVE-2025-38528",
      "id": "msrc_CVE-2025-38528",
      "initial_release_date": "2025-08-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Reject %p% format string in bprintf-like helpers",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38528.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38528\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-08-16T12:15:28.313\",\"lastModified\":\"2026-07-30T06:23:24.350\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Reject %p% format string in bprintf-like helpers\\n\\nstatic const char fmt[] = \\\"%p%\\\";\\n    bpf_trace_printk(fmt, sizeof(fmt));\\n\\nThe above BPF program isn\u0027t rejected and causes a kernel warning at\\nruntime:\\n\\n    Please remove unsupported %\\\\x00 in format string\\n    WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0\\n\\nThis happens because bpf_bprintf_prepare skips over the second %,\\ndetected as punctuation, while processing %p. This patch fixes it by\\nnot skipping over punctuation. %\\\\x00 is then processed in the next\\niteration and rejected.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Rechazo de la cadena de formato %p% en ayudantes similares a bprintf. static const char fmt[] = \\\"%p%\\\"; bpf_trace_printk(fmt, sizeof(fmt)); El programa BPF anterior no se rechaza y genera una advertencia del kernel en tiempo de ejecuci\u00f3n: Por favor, elimine el %\\\\x00 no compatible en la cadena de formato. ADVERTENCIA: CPU: 1 PID: 7244 en lib/vsprintf.c:2680 format_decode+0x49c/0x5d0. Esto ocurre porque bpf_bprintf_prepare omite el segundo %, detectado como signo de puntuaci\u00f3n, al procesar %p. Este parche lo corrige al no omitir la puntuaci\u00f3n. %\\\\x00 se procesa en la siguiente iteraci\u00f3n y se rechaza.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/helpers.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"48cac3f4a96ddf08df8e53809ed066de0dc93915\",\"lessThan\":\"97303e541e12f1fea97834ec64b98991e8775f39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48cac3f4a96ddf08df8e53809ed066de0dc93915\",\"lessThan\":\"61d5fa45ed13e42af14c7e959baba9908b8ee6d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48cac3f4a96ddf08df8e53809ed066de0dc93915\",\"lessThan\":\"e7be679124bae8cf4fa6e40d7e1661baddfb3289\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48cac3f4a96ddf08df8e53809ed066de0dc93915\",\"lessThan\":\"6952aeace93f8c9ea01849efecac24dd3152c9c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48cac3f4a96ddf08df8e53809ed066de0dc93915\",\"lessThan\":\"1c5f5fd47bbda17cb885fe6f03730702cd53d3f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48cac3f4a96ddf08df8e53809ed066de0dc93915\",\"lessThan\":\"f8242745871f81a3ac37f9f51853d12854fd0b58\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/helpers.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.190\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.147\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.100\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.40\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.8\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.13\",\"versionEndExcluding\":\"5.15.190\",\"matchCriteriaId\":\"00A77226-2C17-41C7-BAA0-A33ECE2B2912\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.147\",\"matchCriteriaId\":\"A4FD62FC-0DAE-4ACE-8C9C-66156518C3E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.100\",\"matchCriteriaId\":\"094B81E0-B756-4727-85CA-F3F8D1C9D116\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.40\",\"matchCriteriaId\":\"0099D5A4-B157-4D36-8858-982C7D579030\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.8\",\"matchCriteriaId\":\"C7AFE5B0-F3B1-4D30-B8BF-EDA0385C4746\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"85421F4E-C863-4ABF-B4B4-E887CC2F7F92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3827F0D4-5FEE-4181-B267-5A45E7CA11FC\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1c5f5fd47bbda17cb885fe6f03730702cd53d3f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/61d5fa45ed13e42af14c7e959baba9908b8ee6d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6952aeace93f8c9ea01849efecac24dd3152c9c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/97303e541e12f1fea97834ec64b98991e8775f39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7be679124bae8cf4fa6e40d7e1661baddfb3289\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8242745871f81a3ac37f9f51853d12854fd0b58\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:08:54+00:00",
      "cve": "CVE-2025-38528",
      "id": "CVE-2025-38528",
      "initial_release_date": "2025-08-16T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service in BPF due to format string vulnerability",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38528.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:18:24Z",
      "cve": "CVE-2025-38528",
      "id": "CVE-2025-38528",
      "initial_release_date": "2025-08-16T23:22:41Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "593",
      "product_status:known_not_affected": "270",
      "product_status:recommended": "472",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38528",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38528.json",
      "version": "54"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.