CVE-2025-39748

What it actually does

The BPF verifier fails to maintain consistent register range and tnum invariants on unreachable paths after JSET-based narrowing, resulting in a kernel warning when reg_bounds_sync detects the mismatch.

Why it matters to the business

Systems running affected kernels may experience spurious verifier warnings or crashes when loading certain BPF programs, increasing operational risk for workloads that rely on eBPF for networking, security, or observability; low exploitability and absence from known campaigns reduce immediate urgency but still require patching of production Linux hosts.

How an attack unfolds

An attacker crafts a BPF program containing sequential JMP_EQ and JSET instructions that create an unreachable fall-through path; the verifier walks the path, incorrectly refines bounds after the JSET, violates internal invariants, and triggers a warning. No runtime execution of the unreachable code occurs, and LLVM does not emit JSET, limiting practical use.

How to fix it

Upgrade the Linux kernel to a version containing commit f01e06930444cab289a8783017af9b64255bd103 or later; rebuild and redeploy any out-of-tree BPF programs after the update.

How to confirm the fix worked

Confirm the running kernel contains commit f01e06930444cab289a8783017af9b64255bd103; attempt to load a minimal test program that exercises the original JSET path and verify absence of range-invariant warnings in dmesg.

Typical attack path

1. Compile or hand-craft a BPF program with a JSET instruction followed by an EQ comparison that produces an unreachable branch
2. Load the program via bpf() syscall or a user-space loader on an affected kernel
3. Trigger verifier path exploration that reaches the inconsistent bounds state
4. Observe kernel warning or verifier rejection

How to detect it

Search kernel logs (dmesg, journalctl) for messages containing 'range invariant violation' or 'reg_bounds_sync' originating from the BPF verifier; correlate with bpf() syscall activity from untrusted sources.

• range invariant violation
• reg_bounds_sync
• JSET tnum refinement

What your security team should do

• Prioritize kernel updates on systems that load untrusted or third-party BPF programs
• Monitor EPSS and KEV status for any future increase in exploit maturity
• Add kernel log monitoring for BPF verifier warnings as a temporary detection control