PT-2025-35996 · Linux+3 · Linux Kernel+3

Published 2025-08-05 · Updated 2026-04-20 · CVE-2025-38723

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the BPF subsystem related to jump offset calculation in tailcall functionality. An extra pass during BPF compilation can skip JIT context initialization, leading to an incorrect offset calculation. This results in a negative jump offset in the generated assembly code. A test case involving tailcall bpf2bpf 1 can reveal soft lock issues when the patch is not applied.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

AZL-66791

BDU:2025-15189

CVE-2025-38723

DLA-4328-1

DSA-6009-1

ECHO-F9F6-F8DD-3A0B

MGASA-2025-0234

MGASA-2025-0235

OESA-2025-2310

OESA-2025-2311

OESA-2025-2315

Affected Products

Astra Linux

Debian

Linux Kernel

Red Os

References · 61

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38723.json · Exploit
• https://git.kernel.org/stable/c/f83d469e16bb1f75991ca67c56786fb2aaa42bea · Patch
• https://git.kernel.org/stable/c/cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 · Patch
• https://git.kernel.org/stable/c/17c010fe45def335fe03a0718935416b04c7f349 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38710 · Security Note
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://git.kernel.org/stable/c/1a782fa32e644aa9fbae6c8488f3e61221ac96e1 · Patch
• https://osv.dev/vulnerability/OESA-2025-2311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-38018 · Security Note
• https://osv.dev/vulnerability/MGASA-2025-0234 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE292 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0235 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-38723 · Vendor Advisory