GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-22087 (GCVE-0-2025-22087)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:12 – Updated: 2026-08-05 11:56
VLAI
Title
bpf: Fix array bounds error with may_goto
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly. 2. For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it. 3. For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 011832b97b311bb9e3c27945bc0d1089a14209c9 , < 19e6817f84000d0b06f09fd69ebd56217842c122 (git)
Affected: 011832b97b311bb9e3c27945bc0d1089a14209c9 , < 4524b7febdd55fb99ae2e1f48db64019fa69e643 (git)
Affected: 011832b97b311bb9e3c27945bc0d1089a14209c9 , < 1a86ae57b2600e5749f5f674e9d4296ac00c69a8 (git)
Affected: 011832b97b311bb9e3c27945bc0d1089a14209c9 , < 6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.23 , ≤ 6.12.* (semver)
Unaffected: 6.13.11 , ≤ 6.13.* (semver)
Unaffected: 6.14.2 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19e6817f84000d0b06f09fd69ebd56217842c122",
              "status": "affected",
              "version": "011832b97b311bb9e3c27945bc0d1089a14209c9",
              "versionType": "git"
            },
            {
              "lessThan": "4524b7febdd55fb99ae2e1f48db64019fa69e643",
              "status": "affected",
              "version": "011832b97b311bb9e3c27945bc0d1089a14209c9",
              "versionType": "git"
            },
            {
              "lessThan": "1a86ae57b2600e5749f5f674e9d4296ac00c69a8",
              "status": "affected",
              "version": "011832b97b311bb9e3c27945bc0d1089a14209c9",
              "versionType": "git"
            },
            {
              "lessThan": "6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0",
              "status": "affected",
              "version": "011832b97b311bb9e3c27945bc0d1089a14209c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/core.c",
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix array bounds error with may_goto\n\nmay_goto uses an additional 8 bytes on the stack, which causes the\ninterpreters[] array to go out of bounds when calculating index by\nstack_size.\n\n1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT\ncases, reject loading directly.\n\n2. For non-JIT cases, calculating interpreters[idx] may still cause\nout-of-bounds array access, and just warn about it.\n\n3. For jit_requested cases, the execution of bpf_func also needs to be\nwarned. So move the definition of function __bpf_prog_ret0_warn out of\nthe macro definition CONFIG_BPF_JIT_ALWAYS_ON."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the `bpf(BPF_PROG_LOAD)` syscall and triggered by running the loaded program (e.g. via `SO_ATTACH_BPF` on a local socket). No network-facing service parses attacker data to reach this code.\nAC:L - The attacker fully controls both inputs to the faulty index computation \u2014 a program that uses exactly 512 bytes of stack plus a single `may_goto` instruction deterministically yields `interpreters[16]` on every attempt. No race, timing, or uncontrolled memory-layout condition is involved.\nPR:L - Loading a BPF program requires only an unprivileged local account on systems where `kernel.unprivileged_bpf_disabled=0` (socket-filter/cgroup_skb types load without CAP_BPF), and `may_goto` has no additional capability gate in the verifier. No root or administrative privilege is needed.\nUI:N - The attacker loads and triggers the BPF program entirely on their own; no victim action, mount, or file open is required.\nS:U - The out-of-bounds access and the resulting corrupted control flow are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds read past `interpreters[]` yields a function pointer that is then invoked, causing the BPF interpreter to execute uncontrolled memory as bytecode with unbounded `BPF_LDX` loads, which can be leveraged to disclose arbitrary kernel memory.\nI:H - The wrongly-typed indirect call runs `___bpf_prog_run()` over an uninitialized instruction pointer, so `BPF_STX`/`BPF_ST` stores and `BPF_CALL` dispatches operate on unvalidated addresses \u2014 a memory-corruption and control-flow-hijack primitive.\nA:H - In the common case the bogus interpreter entry hits `BUG_ON(1)` on an unknown opcode or faults on a wild pointer, producing a kernel oops/panic that any local user can trigger on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:41.027Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19e6817f84000d0b06f09fd69ebd56217842c122"
        },
        {
          "url": "https://git.kernel.org/stable/c/4524b7febdd55fb99ae2e1f48db64019fa69e643"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a86ae57b2600e5749f5f674e9d4296ac00c69a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0"
        }
      ],
      "title": "bpf: Fix array bounds error with may_goto",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22087",
    "datePublished": "2025-04-16T14:12:35.359Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2026-08-05T11:56:41.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-22087",
      "date": "2026-09-14",
      "epss": "0.00238",
      "percentile": "0.14889"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-22087\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-16T15:16:02.903\",\"lastModified\":\"2026-07-30T06:22:12.037\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix array bounds error with may_goto\\n\\nmay_goto uses an additional 8 bytes on the stack, which causes the\\ninterpreters[] array to go out of bounds when calculating index by\\nstack_size.\\n\\n1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT\\ncases, reject loading directly.\\n\\n2. For non-JIT cases, calculating interpreters[idx] may still cause\\nout-of-bounds array access, and just warn about it.\\n\\n3. For jit_requested cases, the execution of bpf_func also needs to be\\nwarned. So move the definition of function __bpf_prog_ret0_warn out of\\nthe macro definition CONFIG_BPF_JIT_ALWAYS_ON.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Correcci\u00f3n del error de los l\u00edmites de la matriz con may_goto. may_goto utiliza 8 bytes adicionales en la pila, lo que provoca que la matriz interpreters[] salga de los l\u00edmites al calcular el \u00edndice mediante stack_size. 1. Si se reescribe un programa BPF, reeval\u00fae el tama\u00f1o de la pila. En casos que no sean JIT, rechace la carga directamente. 2. En casos que no sean JIT, el c\u00e1lculo de interpreters[idx] puede seguir provocando un acceso a la matriz fuera de los l\u00edmites y simplemente advertir al respecto. 3. En casos con jit_requested, tambi\u00e9n se debe advertir la ejecuci\u00f3n de bpf_func. Por lo tanto, mueva la definici\u00f3n de la funci\u00f3n __bpf_prog_ret0_warn fuera de la definici\u00f3n de la macro CONFIG_BPF_JIT_ALWAYS_ON.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/core.c\",\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"011832b97b311bb9e3c27945bc0d1089a14209c9\",\"lessThan\":\"19e6817f84000d0b06f09fd69ebd56217842c122\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"011832b97b311bb9e3c27945bc0d1089a14209c9\",\"lessThan\":\"4524b7febdd55fb99ae2e1f48db64019fa69e643\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"011832b97b311bb9e3c27945bc0d1089a14209c9\",\"lessThan\":\"1a86ae57b2600e5749f5f674e9d4296ac00c69a8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"011832b97b311bb9e3c27945bc0d1089a14209c9\",\"lessThan\":\"6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/core.c\",\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.23\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.11\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.2\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.12.23\",\"matchCriteriaId\":\"10F3EB18-ACA3-4775-AC8D-C1CC227D2763\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.11\",\"matchCriteriaId\":\"E7E864B0-8C00-4679-BA55-659B4C9C3AD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14\",\"versionEndExcluding\":\"6.14.2\",\"matchCriteriaId\":\"FADAE5D8-4808-442C-B218-77B2CE8780A0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19e6817f84000d0b06f09fd69ebd56217842c122\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1a86ae57b2600e5749f5f674e9d4296ac00c69a8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4524b7febdd55fb99ae2e1f48db64019fa69e643\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:37:07+00:00",
      "cve": "CVE-2025-22087",
      "id": "CVE-2025-22087",
      "initial_release_date": "2025-04-16T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "160",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix array bounds error with may_goto",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-22087.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:25:01Z",
      "cve": "CVE-2025-22087",
      "id": "CVE-2025-22087",
      "initial_release_date": "2025-04-18T23:19:49Z",
      "product_status:known_not_affected": "467",
      "product_status:recommended": "121",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-22087",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-22087.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.