CVE-2025-39990

What it actually does

A NULL function pointer can be returned from get_helper_proto when a config option disables a helper, allowing invalid access during BPF verification; tail_call helpers are explicitly marked with BPF_PTR_POISON to prevent use.

Why it matters to the business

Unpatched kernels on affected Linux distributions may experience verifier instability or crashes under custom BPF configurations, increasing operational risk and patch urgency for high-dependency systems.

How an attack unfolds

An attacker crafts a BPF program that exercises get_helper_proto under a configuration where the helper table entry is disabled, causing the verifier to dereference a NULL pointer and potentially corrupt memory or crash the kernel.

How to fix it

Apply the upstream fix at commit 3d429cb1278e995e22995ef117fa96d223a67e93 or the equivalent SUSE kgraft-patch-SLE12_Update_32 update that resolves the issue in get_helper_proto.

How to confirm the fix worked

Confirm the running kernel contains commit 3d429cb1278e995e22995ef117fa96d223a67e93 or the matching SUSE patch; re-run BPF verifier test cases that previously triggered the NULL pointer condition.

Typical attack path

1. Identify or force a kernel build with selected BPF helpers disabled
2. Load a crafted BPF program that triggers the affected helper lookup path
3. Trigger verifier execution to reach the unchecked NULL return
4. Exploit resulting invalid pointer for memory corruption or denial of service

How to detect it

Review kernel logs for verifier warnings or NULL pointer dereferences originating from get_helper_proto; inspect BPF program load failures tied to helper function validation.

What your security team should do

• Prioritize kernel upgrades to the listed fixed versions on all production systems
• Audit custom BPF programs and configurations for reliance on disabled helpers
• Monitor EPSS trend and re-evaluate exploit maturity after 30 days