CVE-2025-38591

What it actually does

The BPF verifier incorrectly permits narrower loads against pointer fields in context structures such as __sk_buff.sk; later ctx-access conversion then encounters a zero target_size and emits a verifier bug warning instead of cleanly rejecting the instruction.

Why it matters to the business

Local users or container workloads can trigger kernel warnings that may crash or destabilize systems, increasing operational risk for organizations running recent Linux kernels with BPF programs.

How an attack unfolds

An attacker compiles a minimal BPF program that performs a byte-sized read at the offset of a pointer field inside __sk_buff or similar ctx structures, loads it via bpf(), and causes the verifier to reach the faulty narrow-access path in convert_ctx_accesses, resulting in the kernel warning.

How to fix it

Upgrade the Linux kernel to commit 7847c4140e06f6e87229faae22cc38525334c156 or later. For Chainguard packages, update openjdk-8-openj9 and related variants to 0.53.0-r1 or newer. Restrict unprivileged BPF loading via kernel.unprivileged_bpf_disabled=1 or CAP_BPF until patches are applied.

How to confirm the fix worked

Confirm the kernel commit 7847c4140e06f6e87229faae22cc38525334c156 is present; attempt to load a reproducer BPF program that performs a narrow read on a pointer ctx field and verify the verifier now returns "invalid bpf_context access" instead of a warning.

Typical attack path

1. Identify a host or container running a vulnerable kernel with unprivileged BPF loading permitted.
2. Craft a BPF program containing a u8 load at the offset of a pointer ctx field (e.g., r0 = *(u8 *)(r1 + 169)).
3. Invoke bpf() to load the program; the verifier accepts the narrow access.
4. Trigger the program or rely on bpf_convert_ctx_access to hit the zero-size case and emit the warning.
5. Repeat to produce repeated kernel warnings or potential crashes.

How to detect it

Search kernel logs for the exact verifier warning string; inspect audit or bpftrace logs for attempts to load BPF programs that reference ctx offsets matching known pointer fields; correlate with container runtime events showing unexpected BPF program loads.

What your security team should do

• Apply the referenced kernel commit or package updates immediately on all affected systems.
• Disable unprivileged BPF where not required.
• Monitor for kernel warnings containing "verifier bug: error during ctx access conversion".
• Review BPF programs that access ctx pointer fields for any narrow loads.