What is the CVSS score of CVE-2025-39990?

CVE-2025-39990 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

How to fix or mitigate CVE-2025-39990?

Within 24 hours, audit systems running vulnerable Linux kernels to identify which have eBPF program loading enabled and which user accounts have access to load eBPF programs; prioritize cloud platforms, Kubernetes clusters, and development environments. Within 7 days, restrict eBPF program loading permissions to trusted administrators only via LSM policies (AppArmor, SELinux) or kernel-level access controls, disable CONFIG_BPF_SYSCALL or equivalent eBPF subsystem loading for unprivileged users where operationally feasible, and enable kernel lockdown mode with audit logging for all eBPF loading attempts. Within 30 days, monitor upstream Linux kernel security advisories and distribution vendor advisories for CVE-2025-39990 patches; once available, establish a prioritized patching schedule targeting systems with the highest eBPF exposure and most permissive user access policies.

Linux Kernel CVE-2025-39990

HIGH

2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Intel

High

Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Gain local access with BPF load capability
Delivery

Craft eBPF program calling config-disabled helper
Exploit

Verifier fails to reject NULL helper proto
Execution

Invalid/NULL function pointer dereferenced in kernel
Persist

Kernel crash or memory corruption
Impact

Denial of service or privilege escalation

Vulnerability Assessment

Exploitation Conditions	Requires local code execution and the ability to load eBPF programs (typically CAP_BPF or CAP_SYS_ADMIN, or unprivileged BPF enabled). The exploitation-enabling condition is explicitly stated in the description: the bug only arises on kernels where the relevant config option gating the helper is disabled, leaving the helper function proto NULL in get_helper_proto - on kernels built with that option enabled, the vulnerable NULL path does not exist. Limiting factors: no remote vector (AV:L), no user interaction, privilege to load BPF is needed, and the specific non-default kernel build configuration is required, which meaningfully narrows the real-world exposed population.
Impact	Signals are largely consistent and point to a real but non-urgent local issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) indicates local access with some privilege (loading BPF typically needs CAP_BPF or CAP_SYS_ADMIN) and high impact. EPSS is very low (0.18%, 8th percentile), there is no CISA KEV listing and no public exploit identified, so this is not a mass-exploitation candidate. A key limiting nuance the raw score does not capture: the bug only manifests on kernels built with the specific config option disabled that leaves the helper proto NULL, so many production kernels may not be vulnerable at all - this argues the effective attack complexity is higher than the AC:L in the published vector. Confidentiality/integrity/availability are all rated High, which is defensible because verifier bypasses can escalate to kernel memory corruption, but for many builds the practical outcome is a NULL-deref crash (DoS) rather than confirmed code execution.
Exploit ScenarioDerived	A local user (or a compromised container/process holding BPF load capability) on a vulnerable kernel build crafts an eBPF program that references the helper whose proto is NULL under the disabled config. The verifier fails to reject it, and execution dereferences the invalid function pointer, crashing the kernel or, depending on kernel layout and program construction, corrupting kernel state toward privilege escalation. No public exploit is currently identified, and success requires the specific vulnerable build configuration.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.

RemediationAI

Upstream fix available (commits) - a released patched version is not independently confirmed from the input; apply the kernel update from your distribution that incorporates the stable-tree commits 3d429cb1278e995e22995ef117fa96d223a67e93, 6233715b4b714068d6c831d214a4e8792109875a, or e4414b01c1cd9887bbde92f946c1ba94e40d6d64 (all at git.kernel.org/stable). Until the patched kernel is deployed, the most effective compensating control is to restrict who can load eBPF programs: set the sysctl kernel.unprivileged_bpf_disabled=1 to bar unprivileged BPF (trade-off: breaks unprivileged-BPF workloads, though these are already disabled by default on many distros), and limit CAP_BPF/CAP_SYS_ADMIN grants to trusted processes and constrain container capabilities (trade-off: may affect monitoring/observability tooling like eBPF-based tracing). Rebuilding with the relevant config option enabled also avoids the NULL-proto path, but only if operationally acceptable.

Affected ProductsAI

The Linux kernel eBPF subsystem is affected on builds where the config option guarding the involved helper is disabled, exposing the unchecked NULL helper proto in get_helper_proto. No CPE strings, CWE, or explicit version ranges were provided in the input; affected/fixed versions must be derived from the stable-tree commits. Fixes are recorded in the kernel stable git tree at git.kernel.org (commits 3d429cb1278e995e22995ef117fa96d223a67e93, 6233715b4b714068d6c831d214a4e8792109875a, and e4414b01c1cd9887bbde92f946c1ba94e40d6d64), indicating backports across multiple maintained stable branches.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in the eBPF verifier's helper-resolution path (get_helper_proto) in the Linux kernel. eBPF lets user space load bytecode programs that the in-kernel verifier statically checks before JIT/execution; helper functions are kernel routines BPF programs may call, each described by a bpf_func_proto pointer. A kernel test robot found that when a particular kernel config option gating a helper is disabled, the corresponding helper proto pointer is NULL, yet the verifier did not validate it, so a program could resolve to a NULL/invalid helper. The fix, per Alexei Starovoitov's suggestion, adds an explicit validity check in get_helper_proto and marks the tail_call helper with BPF_PTR_POISON since it is unused by design. CWE is not assigned, but the root-cause class is a NULL pointer dereference / use of an invalid function pointer (CWE-476) originating from missing input validation in the verifier.

Know when Intel gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.0 HIGH

Local BPF-load privilege gives PR:L; dependence on a specific disabled kernel config for the NULL path raises AC:H; verifier bypass can corrupt kernel state, so C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the helper function is valid in get_helper_proto

kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design.

[1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in the Linux kernel eBPF verifier (CVE-2025-39990) enables users with eBPF program loading capabilities to escalate privileges or crash systems through a memory-safety flaw in the verifier logic. The vulnerability affects Linux deployments where untrusted users have local access and eBPF loading permissions, particularly in containerized and cloud environments. With no available patch and a 7.8 CVSS score, organizations must implement compensating controls immediately to prevent exploitation within existing security boundaries.

Business Impact: Medium

Compensating Controls

Restrict eBPF program loading permissions to trusted administrators only through access control policies in the Linux security module (AppArmor, SELinisk, or eBPF-specific LSM). Disable kernel eBPF subsystem loading via kernel configuration (CONFIG_BPF_SYSCALL=n) on systems where eBPF is not operationally required. Implement kernel lockdown mode and enable audit logging to monitor and alert on all eBPF program loading attempts. Enforce strict process isolation and privilege boundaries in container runtimes and virtual environments to limit local attack surface. No vendor-released patch identified at time of analysis.

Threat Intelligence Overview

EPSS Score

0.2%

Top 92% exploitable

Prevalence

Ubiquitous

Linux kernel runs on the vast majority of servers and cloud workloads

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31