CVE-2025-38586

What it actually does

In the ARM64 BPF JIT, exception_boundary programs skip the find_used_callee_regs() call that sets ctx->fp_used, leaving the frame pointer uninitialized in the prologue even when the program uses FP; execution then dereferences an invalid stack pointer and triggers a kernel page fault.

Why it matters to the business

ARM64 Linux systems can suffer abrupt kernel crashes and reboots when specific BPF programs are loaded, causing unplanned downtime, service interruption, and potential loss of in-flight work.

How an attack unfolds

An attacker with the ability to load or attach BPF programs supplies a program that both declares itself an exception boundary and references the frame pointer; the JIT emits a prologue that never saves or sets up FP, so the first FP-using instruction faults and crashes the kernel.

How to fix it

Upgrade the Linux kernel to commit 0dbef493cae7d451f740558665893c000adb2321 or later; for Chainguard packages update openjdk-11-openj9 and related variants to 0.53.0-r0 or newer.

How to confirm the fix worked

Confirm the running kernel contains commit 0dbef493cae7d451f740558665893c000adb2321; verify package versions match the listed fixed releases; test by loading an exception_boundary BPF program that uses FP and ensure no page fault occurs.

Typical attack path

1. Obtain privileges sufficient to load or attach BPF programs on an ARM64 system
2. Craft or obtain a BPF program marked as exception_boundary that also uses the frame pointer
3. Load the program via bpf() or a loader that sets aux->exception_boundary
4. Trigger execution of the program to reach the faulty prologue and induce the page fault

How to detect it

Search kernel logs and dmesg for page-fault oopses originating in the BPF JIT prologue or arm64 exception-boundary paths; correlate timestamps with recent bpf() syscalls or BPF program loads.

What your security team should do

• Apply the kernel or package updates on all ARM64 systems as soon as possible
• Restrict untrusted users and containers from loading BPF programs (CAP_BPF, unprivileged_bpf_disabled)
• Monitor kernel crash logs for BPF-related page faults on ARM64