PT-2025-33805 · Linux+1 · Linux Kernel+1

Published 2025-06-13 · Updated 2025-11-26 · CVE-2025-38607

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The Linux kernel contains an issue where the BPF JSET conditional jump is not correctly handled during control flow graph (CFG) computation. This can lead to incorrect live register and strongly connected component (SCC) calculations. Specifically, the can jump() function in verifier.c does not recognize BPF JSET as a jump instruction. This can cause the verifier to miss potential jump targets, leading to inaccurate register liveness analysis.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-372

Related Identifiers

BDU:2026-02825

CVE-2025-38607

Affected Products

Astra Linux

Linux Kernel

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38607.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-38607 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38607 · Security Note
• https://bdu.fstec.ru/vul/2026-02825 · Security Note
• https://git.kernel.org/stable/c/3157f7e2999616ac91f4d559a8566214f74000a5 · Patch
• https://git.kernel.org/stable/c/65eb166b8636365ad3d6e36d50a7c5edfe6cc66e · Patch
• https://git.kernel.org/stable/c/261b30ad1516f4b9edd500aa6e8d6315c8fc109a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38607 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38607 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-38607 · Vendor Advisory
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.15.10 · Note
• https://lore.kernel.org/linux-cve-announce/2025081922-CVE-2025-38607-c6ce@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1957854123262636376 · Twitter Post
• https://t.me/cveNotify/144117 · Telegram Post