CVE-2025-38202

What it actually does

Missing check for rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() allows the helper to be invoked from sleepable BPF programs without the expected RCU trace lock, triggering warnings when JIT is disabled or on 32-bit hosts.

Why it matters to the business

Organizations running affected Linux kernels in container or observability workloads that use sleepable BPF programs face potential runtime warnings, reduced stability, and increased operational overhead, especially on 32-bit systems or when JIT is disabled; high ecosystem prevalence in Linux distributions amplifies exposure across servers and appliances.

How an attack unfolds

An attacker with the ability to load BPF programs compiles a sleepable program that calls bpf_map_lookup_percpu_elem(), loads it on a vulnerable kernel (JIT disabled or 32-bit), and triggers the missing lock check to produce warnings or instability; threat actors including Advanced Spyware Campaign and groups exploiting related Linux kernel privilege escalations have targeted similar BPF surfaces for initial access or escalation.

How to fix it

Upgrade to fixed kernel commit 2f8c69a72e8ad87b36b8052f789da3cc2b2e186c or later; for Chainguard packages apply gitaly-fips-18.1, gitaly-backup-fips-18.1, gitaly-git-fips-18.1, and gitaly-init-cgroups-fips-18.1 at version 18.1.0-r1 or newer; rebuild and redeploy any custom BPF programs after patching.

How to confirm the fix worked

Confirm the kernel contains commit 2f8c69a72e8ad87b36b8052f789da3cc2b2e186c, verify bpf_map_lookup_percpu_elem() contains the rcu_read_lock_trace_held() guard, and test loading a sleepable BPF program on both JIT-enabled and JIT-disabled configurations without warnings.

Typical attack path

1. Identify or gain local access to load unprivileged or privileged BPF programs
2. Craft a sleepable BPF program invoking bpf_map_lookup_percpu_elem()
3. Load the program on a vulnerable kernel without JIT or on 32-bit hardware
4. Trigger the helper to hit the missing rcu_read_lock_trace check
5. Observe warnings or leverage resulting state for further exploitation

How to detect it

Review kernel logs for warnings originating from bpf_map_lookup_percpu_elem(), inspect BPF program load events via auditd or bpftool, and correlate with activity from known Advanced Spyware Campaign or Linux kernel privilege-escalation tooling; check system call traces for sleepable program loads on vulnerable kernels.

What your security team should do

• Prioritize patching all production kernels to the listed fixed commits within standard change windows
• Audit environments for sleepable BPF programs and 32-bit or JIT-disabled hosts
• Monitor EPSS trend and related threat actor activity for any increase in targeting
• Disable unprivileged BPF loading where not required until patches are applied