Linux kernel BPF verifier: stack pointer in precision backtracking triggers a backtracking bug warning

Impact

A crafted BPF program that compares a register against r10 made __mark_chain_precision() carry the stack pointer register into its bookkeeping, hitting the "verifier backtracking bug" WARN_ONCE at verifier.c:4302. The verifier then returns -EFAULT and rejects the program, so this is a reachable kernel warning rather than a demonstrated memory-safety break - the reporter's artefact is a dmesg splat and a stack trace, not corruption. On a GPU node the thing to check is panic_on_warn: hosts that run with it set will panic and take every job on the node with them, and fleets that run Cilium, bpftrace or any other BPF-heavy agent are the ones where untrusted or semi-trusted programs reach the verifier at all. Verifier state-tracking bugs are also worth patching on principle, since that code is the boundary that keeps a loaded program honest.

Who can reach it

Local. A process able to load a BPF program - CAP_BPF/CAP_SYS_ADMIN, or an unprivileged user where unprivileged BPF is still enabled. Not reachable from the network and not reachable by a tenant pod that is denied bpf(2).

What to do

Move to a stable kernel with commits 2d9a8022009d, 4265682c29c9, ac49b7560b4b or e2d2115e56c4 and reboot. Until then, the exposure is cut by keeping unprivileged BPF off (kernel.unprivileged_bpf_disabled=1) and by not granting CAP_BPF to tenant workloads; clearing panic_on_warn removes the node-level denial of service but leaves the warning.

References

Related entries

• Linux kernel lpfc: use-after-free of the nodelist object during driver unload or fatal error handlingCVE-2025-38289 · Linux kernel lpfc driver (Emulex/Broadcom Fibre Channel HBA, dev_loss_tmo_callbk)High
• Linux kernel (posix-cpu-timers): TOCTOU race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352 · Linux kernel (posix-cpu-timers)High
• Linux kernel idxd: container with /dev mounted can panic the host when the parent process diesCVE-2025-38369 · Linux kernel dmaengine idxd (Intel DSA work-queue teardown with /dev mounted into a container)High
• Linux kernel virtio-net: unchecked received length in xdp_linearize_page allows an out-of-bounds readCVE-2025-38375 · Linux kernel virtio-net (xdp_linearize_page received-length check)High
• Linux i915 GPU kernel driver (GT timeline / VMA allocation): A timeline is left held when VMA allocation fails, soCVE-2025-38389 · Linux i915 GPU kernel driver (GT timeline / VMA allocation)High
• Linux kernel SMC (struct smc_sock type confusion with inet_sock): Struct smc_sock does not embed struct inet_sock asCVE-2025-38475 · Linux kernel SMC (struct smc_sock type confusion with inet_sock)High