CVE-2025-22087

bpf: Fix array bounds error with may_goto

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.24%Up 0.2 points since Apr 17, 2025

What each source reports

CVE List Score used 7.8

bpf: Fix array bounds error with may_goto

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Record: CVE-2025-22087
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-11201 7.8

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Record: EUVD-2025-11201
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-89pr-66m5-4vwv 7.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error...

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Record: GHSA-89pr-66m5-4vwv
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Record: CVE-2025-22087
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2025-22087 7.1

Record: BELL-CVE-2025-22087
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSV 7.8

bpf: Fix array bounds error with may_goto

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size.

If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly.
For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it.
For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Record: CVE-2025-22087
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 11 moreShow less

OSVDEBIAN-CVE-2025-22087 7.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly. 2. For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it. 3. For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Record: DEBIAN-CVE-2025-22087
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:6966 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2025:6966
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-22087 8.4

Record: UBUNTU-CVE-2025-22087
CVSS 4.0: 8.4 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1778276927 No score

kernel: Fix of 35 CVEs

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
xfrm: esp: avoid in-place decrypt on shared skb frags
ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898}
wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315}
net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447}
Squashfs: check metadata block offset is within range {CVE-2026-23388}
nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2024-21803}
crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
firmware_loader: Block path traversal {CVE-2024-47742}
EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068}
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg {CVE-2024-56633}
bpf: Fix array bounds error with may_goto {CVE-2025-22087}
wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb {CVE-2024-56609}
loop: Fix use-after-free issues {CVE-2023-53111}
ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308}
udf: Do not bother merging very long extents {CVE-2023-53506}
ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
net/mlx5: Fix ECVF vports unload on shutdown flow {CVE-2025-38109}
RDMA/irdma: avoid invalid read in irdma_net_event {CVE-2025-71133}
e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}

Record: CLSA-2026-1778276927
Updated: 2026-11-02

OSVUSN-7594-1 No score

linux, linux-gcp, linux-raspi, linux-realtime vulnerabilities