CVE-2025-38012 (GCVE-0-2025-38012)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:28 – Updated: 2026-08-05 11:58
VLAI
Title
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
Summary
In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpf_for_each() macro ignores error returns from new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized state after an error return causing bpf_iter_scx_dsq_next() to dereference garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that next() and destroy() become noops.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 650ba21b131ed1f8ee57826b2c6295a3be221132 , < 0102989af4c334d1d98b2a0fd4d61a5152e39b72 (git)
Affected: 650ba21b131ed1f8ee57826b2c6295a3be221132 , < 255dd31bfc4a67a19b1fc2cd130a50284dadfe3a (git)
Affected: 650ba21b131ed1f8ee57826b2c6295a3be221132 , < 428dc9fc0873989d73918d4a9cc22745b7bbc799 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.30 , ≤ 6.12.* (semver)
Unaffected: 6.14.8 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0102989af4c334d1d98b2a0fd4d61a5152e39b72",
              "status": "affected",
              "version": "650ba21b131ed1f8ee57826b2c6295a3be221132",
              "versionType": "git"
            },
            {
              "lessThan": "255dd31bfc4a67a19b1fc2cd130a50284dadfe3a",
              "status": "affected",
              "version": "650ba21b131ed1f8ee57826b2c6295a3be221132",
              "versionType": "git"
            },
            {
              "lessThan": "428dc9fc0873989d73918d4a9cc22745b7bbc799",
              "status": "affected",
              "version": "650ba21b131ed1f8ee57826b2c6295a3be221132",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.30",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: bpf_iter_scx_dsq_new() should always initialize iterator\n\nBPF programs may call next() and destroy() on BPF iterators even after new()\nreturns an error value (e.g. bpf_for_each() macro ignores error returns from\nnew()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized\nstate after an error return causing bpf_iter_scx_dsq_next() to dereference\ngarbage data. Make bpf_iter_scx_dsq_new() always clear $kit-\u003edsq so that\nnext() and destroy() become noops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires loading and running a BPF program via the local `bpf()` syscall (BPF_PROG_LOAD + BPF_PROG_TEST_RUN, or a struct_ops/tracing attach). There is no remote or adjacent-network path to the sched_ext DSQ iterator kfuncs.\nAC:L - The trigger is fully deterministic \u2014 pass an invalid flag bit to `bpf_iter_scx_dsq_new()` and call `next()` \u2014 with no race, no timing window, and no dependence on ambient memory layout, since the attacker pre-seeds the iterator stack slots with values of their choosing. `CONFIG_SCHED_CLASS_EXT` is enabled in mainstream 6.12+ distro kernels.\nPR:L - Only CAP_BPF is needed: the iterator kfuncs are registered for `BPF_PROG_TYPE_SYSCALL`, which is not perfmon/net-admin gated, and `bpf_prog_test_run_syscall()` adds no capability check. `bpf_token_capable()` allows CAP_BPF to be delegated into an unprivileged user namespace via a bpffs BPF token, so an ordinary low-privileged container user can reach it.\nUI:N - The attacker\u0027s own BPF program triggers the flaw synchronously; no victim action, mount, or file open is involved.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority \u2014 a standard local privilege escalation with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - `nldsq_next_task()` dereferences the attacker-supplied `kit-\u003edsq` pointer and then walks arbitrary `list_head` next/prev chains, yielding an arbitrary kernel-memory read primitive that can disclose credentials, keys, and KASLR state.\nI:H - The uninitialized `kit-\u003ecursor` drives `list_move()`/`list_del_init()` against attacker-chosen addresses, and `raw_spin_lock_irqsave(\u0026kit-\u003edsq-\u003elock)` performs a read-modify-write at an arbitrary address \u2014 a controlled kernel write primitive leading to full privilege escalation.\nA:H - Dereferencing garbage pointers under `raw_spin_lock_irqsave()` reliably produces a kernel oops or a hard lockup on a bogus spinlock, and any unprivileged-BPF-capable process can repeat it at will to panic the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:57.764Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0102989af4c334d1d98b2a0fd4d61a5152e39b72"
        },
        {
          "url": "https://git.kernel.org/stable/c/255dd31bfc4a67a19b1fc2cd130a50284dadfe3a"
        },
        {
          "url": "https://git.kernel.org/stable/c/428dc9fc0873989d73918d4a9cc22745b7bbc799"
        }
      ],
      "title": "sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38012",
    "datePublished": "2025-06-18T09:28:22.057Z",
    "dateReserved": "2025-04-16T04:51:23.977Z",
    "dateUpdated": "2026-08-05T11:58:57.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38012",
      "date": "2026-09-22",
      "epss": "0.00197",
      "percentile": "0.09684"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/sched/ext.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0102989af4c334d1d98b2a0fd4d61a5152e39b72",
                    "status": "affected",
                    "version": "650ba21b131ed1f8ee57826b2c6295a3be221132",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "255dd31bfc4a67a19b1fc2cd130a50284dadfe3a",
                    "status": "affected",
                    "version": "650ba21b131ed1f8ee57826b2c6295a3be221132",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "428dc9fc0873989d73918d4a9cc22745b7bbc799",
                    "status": "affected",
                    "version": "650ba21b131ed1f8ee57826b2c6295a3be221132",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/sched/ext.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.12"
                  },
                  {
                    "lessThan": "6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.30",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.14.*",
                    "status": "unaffected",
                    "version": "6.14.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.15",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F3FBF2D7-2AEE-456E-97E5-22E9926488AF",
                    "versionEndExcluding": "6.12.30",
                    "versionStartIncluding": "6.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D4458049-AD51-4F1B-BAB9-C32B53A54DE1",
                    "versionEndExcluding": "6.14.8",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "90320558-E553-4EF5-8A0B-0F5D20113BD2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: bpf_iter_scx_dsq_new() should always initialize iterator\n\nBPF programs may call next() and destroy() on BPF iterators even after new()\nreturns an error value (e.g. bpf_for_each() macro ignores error returns from\nnew()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized\nstate after an error return causing bpf_iter_scx_dsq_next() to dereference\ngarbage data. Make bpf_iter_scx_dsq_new() always clear $kit-\u003edsq so that\nnext() and destroy() become noops."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched_ext: bpf_iter_scx_dsq_new() siempre debe inicializar el iterador. Los programas BPF pueden llamar a next() y destroy() en iteradores BPF incluso despu\u00e9s de que new() devuelva un valor de error (p. ej., la macro bpf_for_each() ignora los errores devueltos por new()). bpf_iter_scx_dsq_new() podr\u00eda dejar el iterador sin inicializar despu\u00e9s de un error, lo que provoca que bpf_iter_scx_dsq_next() desreferencia datos innecesarios. Aseg\u00farese de que bpf_iter_scx_dsq_new() siempre borre $kit-\u0026gt;dsq para que next() y destroy() se conviertan en noops."
          }
        ],
        "id": "CVE-2025-38012",
        "lastModified": "2026-07-30T06:22:44.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-06-18T10:15:32.560",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0102989af4c334d1d98b2a0fd4d61a5152e39b72"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/255dd31bfc4a67a19b1fc2cd130a50284dadfe3a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/428dc9fc0873989d73918d4a9cc22745b7bbc799"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-908"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:18:22+00:00",
      "cve": "CVE-2025-38012",
      "id": "CVE-2025-38012",
      "initial_release_date": "2025-06-18T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38012.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:01:49Z",
      "cve": "CVE-2025-38012",
      "id": "CVE-2025-38012",
      "initial_release_date": "2025-06-19T03:16:27Z",
      "product_status:known_not_affected": "509",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38012",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38012.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.