CVE-2025-38723

The extra pass of bpfintjitcompile() skips JIT context initialization which essentially skips offset calculation leaving outoffset = -1, so the jmpoffset in emitbpftailcall is calculated by

"#define jmpoffset (outoffset - (cur_offset))"

is a negative number, which is wrong. The final generated assembly are as follow.

54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c

Before apply this patch, the follow test case will reveal soft lock issues.

cd tools/testing/selftests/bpf/ ./testprogs --allow=tailcalls/tailcallbpf2bpf_1

dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5dc615520c4dfb358245680f1904bad61116648e

Fixed

1a782fa32e644aa9fbae6c8488f3e61221ac96e1

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5dc615520c4dfb358245680f1904bad61116648e

Fixed

17c010fe45def335fe03a0718935416b04c7f349

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5dc615520c4dfb358245680f1904bad61116648e

Fixed

f83d469e16bb1f75991ca67c56786fb2aaa42bea

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5dc615520c4dfb358245680f1904bad61116648e

Fixed

f2b5e50cc04d7a049b385bc1c93b9cbf5f10c94f

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5dc615520c4dfb358245680f1904bad61116648e

Fixed

9262e3e04621558e875eb5afb5e726b648cd5949

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5dc615520c4dfb358245680f1904bad61116648e

Fixed

cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3

Affected versions

v6.*

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.100

v6.1.101

v6.1.102

v6.1.103

v6.1.104

v6.1.105

v6.1.106

v6.1.107

v6.1.108

v6.1.109

v6.1.11

v6.1.110

v6.1.111

v6.1.112

v6.1.113

v6.1.114

v6.1.115

v6.1.116

v6.1.117

v6.1.118

v6.1.119

v6.1.12

v6.1.120

v6.1.121

v6.1.122

v6.1.123

v6.1.124

v6.1.125

v6.1.126

v6.1.127

v6.1.128

v6.1.129

v6.1.13

v6.1.130

v6.1.131

v6.1.132

v6.1.133

v6.1.134

v6.1.135

v6.1.136

v6.1.137

v6.1.138

v6.1.139

v6.1.14

v6.1.140

v6.1.141

v6.1.142

v6.1.143

v6.1.144

v6.1.145

v6.1.146

v6.1.147

v6.1.148

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.53

v6.1.54

v6.1.55

v6.1.56

v6.1.57

v6.1.58

v6.1.59

v6.1.6

v6.1.60

v6.1.61

v6.1.62

v6.1.63

v6.1.64

v6.1.65

v6.1.66

v6.1.67

v6.1.68

v6.1.69

v6.1.7

v6.1.70

v6.1.71

v6.1.72

v6.1.73

v6.1.74

v6.1.75

v6.1.76

v6.1.77

v6.1.78

v6.1.79

v6.1.8

v6.1.80

v6.1.81

v6.1.82

v6.1.83

v6.1.84

v6.1.85

v6.1.86

v6.1.87

v6.1.88

v6.1.89

v6.1.9

v6.1.90

v6.1.91

v6.1.92

v6.1.93

v6.1.94

v6.1.95

v6.1.96

v6.1.97

v6.1.98

v6.1.99

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.12.1

v6.12.10

v6.12.11

v6.12.12

v6.12.13

v6.12.14

v6.12.15

v6.12.16

v6.12.17

v6.12.18

v6.12.19

v6.12.2

v6.12.20

v6.12.21

v6.12.22

v6.12.23

v6.12.24

v6.12.25

v6.12.26

v6.12.27

v6.12.28

v6.12.29

v6.12.3

v6.12.30

v6.12.31

v6.12.32

v6.12.33

v6.12.34

v6.12.35

v6.12.36

v6.12.37

v6.12.38

v6.12.39

v6.12.4

v6.12.40

v6.12.41

v6.12.42

v6.12.5

v6.12.6

v6.12.7

v6.12.8

v6.12.9

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.14

v6.14-rc1

v6.14-rc2

v6.14-rc3

v6.14-rc4

v6.14-rc5

v6.14-rc6

v6.14-rc7

v6.15

v6.15-rc1

v6.15-rc2

v6.15-rc3

v6.15-rc4

v6.15-rc5

v6.15-rc6

v6.15-rc7

v6.15.1

v6.15.10

v6.15.2

v6.15.3

v6.15.4

v6.15.5

v6.15.6

v6.15.7

v6.15.8

v6.15.9

v6.16

v6.16-rc1

v6.16-rc2

v6.16-rc3

v6.16-rc4

v6.16-rc5

v6.16-rc6

v6.16-rc7

v6.16.1

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.100

v6.6.101

v6.6.102

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.33

v6.6.34

v6.6.35

v6.6.36

v6.6.37

v6.6.38

v6.6.39

v6.6.4

v6.6.40

v6.6.41

v6.6.42

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.5

v6.6.50

v6.6.51

v6.6.52

v6.6.53

v6.6.54

v6.6.55

v6.6.56

v6.6.57

v6.6.58

v6.6.59

v6.6.6

v6.6.60

v6.6.61

v6.6.62

v6.6.63

v6.6.64

v6.6.65

v6.6.66

v6.6.67

v6.6.68

v6.6.69

v6.6.7

v6.6.70

v6.6.71

v6.6.72

v6.6.73

v6.6.74

v6.6.75

v6.6.76

v6.6.77

v6.6.78

v6.6.79

v6.6.8

v6.6.80

v6.6.81

v6.6.82

v6.6.83

v6.6.84

v6.6.85

v6.6.86

v6.6.87

v6.6.88

v6.6.89

v6.6.9

v6.6.90

v6.6.91

v6.6.92

v6.6.93

v6.6.94

v6.6.95

v6.6.96

v6.6.97

v6.6.98

v6.6.99

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "241918539155888064674267418325946152487",
                "27623836629324130967697185855290602149",
                "36082226743910044135360027195759037447",
                "180368973274885450596148484745203323311",
                "184438273854616014095546788737391583051",
                "56236786984905616241822484355778039223",
                "121822058385309247611481538856302171764",
                "258622763724227865740262250476896877955",
                "158669300321310511323167069182072792721",
                "255624331042450861013699233160908005310",
                "55943080808049156638300765573697567921",
                "325806962316063596878697147800038442119",
                "168995696438279499837882702829815086638",
                "102489806320040633301897159029710252249",
                "24070915576175972051345482049865935743",
                "58601955751293678806910825626137531783",
                "310013153137958115240211958166911729404",
                "311809852199050346840451067626341611955",
                "225283922673991446421275707741463738029",
                "87450943866160093608141494285935465654",
                "157767224558220386231644911265633271440",
                "116998501907567589983366743892097768543",
                "138697662855508207062361698258899740727",
                "181356965977578295187165331294286176714",
                "20640850212991142756597653449662096882",
                "303066529738926562258864311132943755254",
                "60330375367689501031598593109390778039",
                "25488196546480466555327481170809903904"
            ]
        },
        "id": "CVE-2025-38723-2f9d0fae",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83d469e16bb1f75991ca67c56786fb2aaa42bea",
        "target": {
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "241918539155888064674267418325946152487",
                "27623836629324130967697185855290602149",
                "36082226743910044135360027195759037447",
                "180368973274885450596148484745203323311",
                "184438273854616014095546788737391583051",
                "56236786984905616241822484355778039223",
                "121822058385309247611481538856302171764",
                "258622763724227865740262250476896877955",
                "158669300321310511323167069182072792721",
                "255624331042450861013699233160908005310",
                "55943080808049156638300765573697567921",
                "325806962316063596878697147800038442119",
                "168995696438279499837882702829815086638",
                "102489806320040633301897159029710252249",
                "24070915576175972051345482049865935743",
                "58601955751293678806910825626137531783",
                "310013153137958115240211958166911729404",
                "311809852199050346840451067626341611955",
                "225283922673991446421275707741463738029",
                "87450943866160093608141494285935465654",
                "157767224558220386231644911265633271440",
                "116998501907567589983366743892097768543",
                "138697662855508207062361698258899740727",
                "181356965977578295187165331294286176714",
                "20640850212991142756597653449662096882",
                "303066529738926562258864311132943755254",
                "60330375367689501031598593109390778039",
                "25488196546480466555327481170809903904"
            ]
        },
        "id": "CVE-2025-38723-3202fded",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
        "target": {
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "118278255554371825267153487392239021922",
            "length": 15829.0
        },
        "id": "CVE-2025-38723-38af3f39",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83d469e16bb1f75991ca67c56786fb2aaa42bea",
        "target": {
            "function": "build_insn",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "175379204490756836125263486437277757128",
            "length": 2735.0
        },
        "id": "CVE-2025-38723-52f6e314",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83d469e16bb1f75991ca67c56786fb2aaa42bea",
        "target": {
            "function": "bpf_int_jit_compile",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "241918539155888064674267418325946152487",
                "27623836629324130967697185855290602149",
                "36082226743910044135360027195759037447",
                "180368973274885450596148484745203323311",
                "184438273854616014095546788737391583051",
                "56236786984905616241822484355778039223",
                "121822058385309247611481538856302171764",
                "258622763724227865740262250476896877955",
                "158669300321310511323167069182072792721",
                "255624331042450861013699233160908005310",
                "55943080808049156638300765573697567921",
                "325806962316063596878697147800038442119",
                "168995696438279499837882702829815086638",
                "102489806320040633301897159029710252249",
                "24070915576175972051345482049865935743",
                "58601955751293678806910825626137531783",
                "310013153137958115240211958166911729404",
                "311809852199050346840451067626341611955",
                "225283922673991446421275707741463738029",
                "87450943866160093608141494285935465654",
                "157767224558220386231644911265633271440",
                "116998501907567589983366743892097768543",
                "138697662855508207062361698258899740727",
                "181356965977578295187165331294286176714",
                "20640850212991142756597653449662096882",
                "303066529738926562258864311132943755254",
                "179898912002883231807499566968567407725",
                "198188337431661858583372518290295875411"
            ]
        },
        "id": "CVE-2025-38723-5e4fea12",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17c010fe45def335fe03a0718935416b04c7f349",
        "target": {
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "193712342559257359843992318915822879756",
            "length": 2597.0
        },
        "id": "CVE-2025-38723-aae12d4f",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17c010fe45def335fe03a0718935416b04c7f349",
        "target": {
            "function": "bpf_int_jit_compile",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "315187623072560436990859591618414744923",
            "length": 1260.0
        },
        "id": "CVE-2025-38723-b43240fd",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f83d469e16bb1f75991ca67c56786fb2aaa42bea",
        "target": {
            "function": "emit_bpf_tail_call",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "226859899954257416189691568005179152384",
            "length": 13869.0
        },
        "id": "CVE-2025-38723-b792e778",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17c010fe45def335fe03a0718935416b04c7f349",
        "target": {
            "function": "build_insn",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "118278255554371825267153487392239021922",
            "length": 15829.0
        },
        "id": "CVE-2025-38723-be956108",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
        "target": {
            "function": "build_insn",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "175379204490756836125263486437277757128",
            "length": 2735.0
        },
        "id": "CVE-2025-38723-c44b678a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
        "target": {
            "function": "bpf_int_jit_compile",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "315187623072560436990859591618414744923",
            "length": 1260.0
        },
        "id": "CVE-2025-38723-d6935a6c",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3",
        "target": {
            "function": "emit_bpf_tail_call",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "function_hash": "315187623072560436990859591618414744923",
            "length": 1260.0
        },
        "id": "CVE-2025-38723-d927b980",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@17c010fe45def335fe03a0718935416b04c7f349",
        "target": {
            "function": "emit_bpf_tail_call",
            "file": "arch/loongarch/net/bpf_jit.c"
        }
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.1.0

Fixed

6.1.149

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.103

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.43

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.15.11

Type: ECOSYSTEM
Events: Introduced

6.16.0

Fixed

6.16.2