CVE-2025-38528

Katalog CVE

CVSS 5.5 · Medium EPSS 0,17%

Kerentanan pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.

Rincian

Terbit di NVD

16 Agustus 2025

Terakhir diubah

30 Juli 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/1c5f5fd47bbda17cb885fe6f03730702cd53d3f8 patch
• https://git.kernel.org/stable/c/61d5fa45ed13e42af14c7e959baba9908b8ee6d4 patch
• https://git.kernel.org/stable/c/6952aeace93f8c9ea01849efecac24dd3152c9c9 patch
• https://git.kernel.org/stable/c/97303e541e12f1fea97834ec64b98991e8775f39 patch
• https://git.kernel.org/stable/c/e7be679124bae8cf4fa6e40d7e1661baddfb3289 patch
• https://git.kernel.org/stable/c/f8242745871f81a3ac37f9f51853d12854fd0b58 patch
• https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html mailing list · advisory pihak ketiga