CVE-2025-39990

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the helper function is valid in get_helper_proto

kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design.

[1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= f470378c7562a2818b45ed11c98973f2b89eedd3, < dfbff47f120e4b0793ca0e0b8660361ccac25a74; >= f470378c7562a2818b45ed11c98973f2b89eedd3, < 3d429cb1278e995e22995ef117fa96d223a67e93; >= f470378c7562a2818b45ed11c98973f2b89eedd3, < 6233715b4b714068d6c831d214a4e8792109875a; >= f470378c7562a2818b45ed11c98973f2b89eedd3, < e4414b01c1cd9887bbde92f946c1ba94e40d6d64
LinuxLinux5.8

References

Timeline

Published
Oct 15, 2025
Last modified
Oct 21, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-39991In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.mCVE-2025-39992In the Linux kernel, the following vulnerability has been resolved: mm: swap: check for stable address space before operating on the VMA ICVE-2025-399937.8In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issCVE-2025-399947.3In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The originaCVE-2025-39995In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer inCVE-2025-39996In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pcCVE-2025-39997In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The preCVE-2025-399987.1In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer ovCVE-2025-39999In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix blk_mq_tags double free while nr_requests grown In the casCVE-2025-40005.4A vulnerability, which was classified as problematic, was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. Affected is an unknown CVE-2025-400008.8In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() TCVE-2025-40001In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the deta
CVE-2025-39990: High severity, CVSS 7.8 | Vulnix