What is the CVSS score of CVE-2025-39990?

CVE-2025-39990 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2025-39990?

A local privilege escalation vulnerability in the Linux kernel eBPF verifier (CVE-2025-39990) enables users with eBPF program loading capabilities to escalate privileges or crash systems through a…. A patch is available.

How to fix or mitigate CVE-2025-39990?

Within 24 hours, audit systems running vulnerable Linux kernels to identify which have eBPF program loading enabled and which user accounts have access to load eBPF programs; prioritize cloud platforms, Kubernetes clusters, and development environments. Within 7 days, restrict eBPF program loading permissions to trusted administrators only via LSM policies (AppArmor, SELinux) or kernel-level access controls, disable CONFIG_BPF_SYSCALL or equivalent eBPF subsystem loading for unprivileged users where operationally feasible, and enable kernel lockdown mode with audit logging for all eBPF loading attempts. Within 30 days, monitor upstream Linux kernel security advisories and distribution vendor advisories for CVE-2025-39990 patches; once available, establish a prioritized patching schedule targeting systems with the highest eBPF exposure and most permissive user access policies.

Linux Kernel CVE-2025-39990

HIGH

2025-10-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Red Hat Intel Suse

High

Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Low–High)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local BPF-load privilege gives PR:L; dependence on a specific disabled kernel config for the NULL path raises AC:H; verifier bypass can corrupt kernel state, so C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:03 vuln.today

CVE Published

Oct 15, 2025 - 08:15 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check the helper function is valid in get_helper_proto

kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option.

As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design.

[1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com

AnalysisAI

Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.

Technical ContextAI

The vulnerability lives in the eBPF verifier's helper-resolution path (get_helper_proto) in the Linux kernel. eBPF lets user space load bytecode programs that the in-kernel verifier statically checks before JIT/execution; helper functions are kernel routines BPF programs may call, each described by a bpf_func_proto pointer. A kernel test robot found that when a particular kernel config option gating a helper is disabled, the corresponding helper proto pointer is NULL, yet the verifier did not validate it, so a program could resolve to a NULL/invalid helper. The fix, per Alexei Starovoitov's suggestion, adds an explicit validity check in get_helper_proto and marks the tail_call helper with BPF_PTR_POISON since it is unused by design. CWE is not assigned, but the root-cause class is a NULL pointer dereference / use of an invalid function pointer (CWE-476) originating from missing input validation in the verifier.

Affected ProductsAI

The Linux kernel eBPF subsystem is affected on builds where the config option guarding the involved helper is disabled, exposing the unchecked NULL helper proto in get_helper_proto. No CPE strings, CWE, or explicit version ranges were provided in the input; affected/fixed versions must be derived from the stable-tree commits. Fixes are recorded in the kernel stable git tree at git.kernel.org (commits 3d429cb1278e995e22995ef117fa96d223a67e93, 6233715b4b714068d6c831d214a4e8792109875a, and e4414b01c1cd9887bbde92f946c1ba94e40d6d64), indicating backports across multiple maintained stable branches.

RemediationAI

Upstream fix available (commits) - a released patched version is not independently confirmed from the input; apply the kernel update from your distribution that incorporates the stable-tree commits 3d429cb1278e995e22995ef117fa96d223a67e93, 6233715b4b714068d6c831d214a4e8792109875a, or e4414b01c1cd9887bbde92f946c1ba94e40d6d64 (all at git.kernel.org/stable). Until the patched kernel is deployed, the most effective compensating control is to restrict who can load eBPF programs: set the sysctl kernel.unprivileged_bpf_disabled=1 to bar unprivileged BPF (trade-off: breaks unprivileged-BPF workloads, though these are already disabled by default on many distros), and limit CAP_BPF/CAP_SYS_ADMIN grants to trusted processes and constrain container capabilities (trade-off: may affect monitoring/observability tooling like eBPF-based tracing). Rebuilding with the relevant config option enabled also avoids the NULL-proto path, but only if operationally acceptable.

More in Intel

View all

CVE-2021-44228 CRITICAL Act Now POC

10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c

CVE-2017-5689 CRITICAL Act Now POC

9.8 May 02

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Mana

CVE-2012-5958 CRITICAL Act Now POC

10.0 Jan 31