CVE-2025-38012

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38012
In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpf_for_each() macro ignores error returns from new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized state after an error return causing bpf_iter_scx_dsq_next() to dereference garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that next() and destroy() become noops.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0102989af4c334d1d98b2a0fd4d61a5152e39b72 Patch
https://git.kernel.org/stable/c/255dd31bfc4a67a19b1fc2cd130a50284dadfe3a Patch
https://git.kernel.org/stable/c/428dc9fc0873989d73918d4a9cc22745b7bbc799 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
History

17 Nov 2025, 12:56

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sched_ext: bpf_iter_scx_dsq_new() siempre debe inicializar el iterador. Los programas BPF pueden llamar a next() y destroy() en iteradores BPF incluso después de que new() devuelva un valor de error (p. ej., la macro bpf_for_each() ignora los errores devueltos por new()). bpf_iter_scx_dsq_new() podría dejar el iterador sin inicializar después de un error, lo que provoca que bpf_iter_scx_dsq_next() desreferencia datos innecesarios. Asegúrese de que bpf_iter_scx_dsq_new() siempre borre $kit->dsq para que next() y destroy() se conviertan en noops.
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/0102989af4c334d1d98b2a0fd4d61a5152e39b72 - () https://git.kernel.org/stable/c/0102989af4c334d1d98b2a0fd4d61a5152e39b72 - Patch
References () https://git.kernel.org/stable/c/255dd31bfc4a67a19b1fc2cd130a50284dadfe3a - () https://git.kernel.org/stable/c/255dd31bfc4a67a19b1fc2cd130a50284dadfe3a - Patch
References () https://git.kernel.org/stable/c/428dc9fc0873989d73918d4a9cc22745b7bbc799 - () https://git.kernel.org/stable/c/428dc9fc0873989d73918d4a9cc22745b7bbc799 - Patch
CWE CWE-908
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*

18 Jun 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 10:15

Updated : 2025-11-17 12:56

NVD link : CVE-2025-38012

Mitre link : CVE-2025-38012

CVE.ORG link : CVE-2025-38012

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource