Resource management error in Linux kernel bpf

1) Resource management error

EUVDB-ID: #VU112328

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-38202

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the BPF_CALL_3() function in kernel/bpf/helpers.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/2d834477bbc1e8b8a59ff8b0c081529d6bed7b22
https://git.kernel.org/stable/c/2f8c69a72e8ad87b36b8052f789da3cc2b2e186c
https://git.kernel.org/stable/c/7bf4461f1c97207fda757014690d55a447ce859f
https://git.kernel.org/stable/c/b522d4d334f206284b1a44b0b0b2f99fd443b39b
https://git.kernel.org/stable/c/d4965578267e2e81f67c86e2608481e77e9c8569

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.