CVE-2025-38489

What it actually does

The flaw reintroduces a missing check in s390 BPF architecture support for bpf_arch_text_poke() when new_addr is NULL, allowing pointer arithmetic errors that trigger intermittent kernel panics during operations such as perf on_switch() programs.

Why it matters to the business

Organizations running affected Linux kernels on s390 hardware face unplanned system crashes and instability when using BPF-based tooling, increasing downtime risk and operational overhead; the issue appears in widely deployed Debian-packaged browser environments with moderate ecosystem reach.

How an attack unfolds

An attacker with the ability to load or trigger BPF programs on s390 systems can exercise the reintroduced pointer arithmetic bug, causing the kernel to panic; threat actors including Advanced Spyware Campaign and various Linux kernel privilege escalation groups have been observed targeting similar kernel memory issues.

How to fix it

Update to fixed package versions: thunderbird on Debian 11/12/13 to 1:128.13.0esr-1~deb11u1 / 1:128.13.0esr-1~deb12u1 / 1:128.13.0esr-1 respectively; firefox-esr on Debian 11/12/13 to 128.13.0esr-1~deb11u1 / 128.13.0esr-1~deb12u1 / 128.13.0esr-1; apply kernel patches restoring the bpf_arch_text_poke NULL handling.

How to confirm the fix worked

Confirm kernel version contains the restored commit and comment from c730fce7c70c; test BPF program paths such as perf on_switch() for absence of panics; verify package versions match the listed fixed releases on Debian systems.

Typical attack path

1. Identify s390 Linux systems running vulnerable kernels with BPF enabled
2. Load or trigger a BPF program path that invokes bpf_arch_text_poke with NULL new_addr
3. Trigger the missing fix path to induce pointer arithmetic error
4. Cause kernel panic and potential denial of service or follow-on exploitation

How to detect it

Review kernel crash logs and dmesg for s390 BPF text poke failures; correlate with perf or BPF program activity; look for indicators from Advanced Spyware Campaign or listed privilege escalation patterns targeting similar kernel issues.

What your security team should do

• Prioritize patching s390 systems within the next 30 days given EPSS upward trend and related threat actor activity
• Audit environments for BPF usage on s390 and enable crash logging to detect panics
• Monitor for similar memory corruption patterns in Linux kernel privilege escalation campaigns