AZL-66410
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-66410.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-66410
- Upstream
- Published
- 2025-08-16T12:15:28Z
- Modified
- 2026-04-01T05:21:46.510684Z
- Summary
- CVE-2025-38528 affecting package kernel for versions less than 6.6.104.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject %p% format string in bprintf-like helpers
static const char fmt[] = "%p%"; bpftraceprintk(fmt, sizeof(fmt));
The above BPF program isn't rejected and causes a kernel warning at runtime:
Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0This happens because bpfbprintfprepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.
- References