CVE-2025-38466

What it actually does

Authorization bypass allowing non-privileged local users to attach uprobes to arbitrary offsets, bypassing the intended CAP_SYS_ADMIN requirement; the kernel validates only instruction presence but cannot account for variable-length instructions or data-in-text-segment architectures, enabling destructive probe placement that can crash or destabilize execution streams.

Why it matters to the business

Local users on affected Linux systems can trigger availability issues or system instability without administrative rights, increasing operational risk on any environment relying on perf/uprobes; the large number of downstream kernel dependents amplifies exposure across distributions and embedded devices.

How an attack unfolds

A local attacker with a user account invokes perf or direct uprobe interfaces to place probes at mid-instruction offsets or data words mistaken for code; because privilege checks are absent, the probe executes destructively during normal instruction fetch, leading to crashes. Threat actors such as Advanced Spyware Campaign and VMSCAPE, along with related Linux kernel privilege-escalation activity, have been observed targeting similar kernel surfaces.

How to fix it

Upgrade the Linux kernel to a fixed commit (d7ef1afd5b3f43f4924326164cee5397b66abd9c or later stable equivalent). For rtpengine users, deploy version 12.5.1.35-1 or the sipwise/rtpengine commit 767a3a501a250b5d2b23a40c3679a12667251446. Rebuild and reboot after applying the patch; disable uprobes entirely if the feature is unused.

How to confirm the fix worked

Confirm the running kernel contains commit d7ef1afd5b3f43f4924326164cee5397b66abd9c; attempt uprobe attachment from a non-root user and verify EPERM or equivalent is returned; review kernel build configuration for CONFIG_UPROBE_EVENTS=y and test with perf probe under unprivileged accounts.

Typical attack path

1. Obtain local unprivileged shell on target Linux system
2. Use perf_event_open or uprobe syscalls to register probe at chosen offset without CAP_SYS_ADMIN
3. Trigger execution path that reaches the probed location, causing misaligned or invalid instruction handling
4. Induce kernel panic, process termination, or denial of service

How to detect it

Search kernel audit logs and perf event records for uprobe creation attempts by non-root UIDs; inspect dmesg or kernel logs for instruction-fetch or uprobe-related warnings; correlate with threat-actor TTPs such as those listed for Advanced Spyware Campaign and VMSCAPE.

What your security team should do

• Prioritize kernel upgrade on all internet-facing or multi-tenant systems within the CISA-style remediation window if applicable
• Audit systems for non-root use of perf or uprobe interfaces via auditd or eBPF monitoring
• Apply least-privilege controls and consider disabling uprobes where not required
• Monitor EPSS trend (currently rising) and threat-actor activity for similar kernel surfaces