Linux kernel BPF: missing destination length check in bpf_crypto_crypt allows out-of-bounds write

Impact

The bpf_crypto_crypt() kfunc passed the source dynptr's length to the crypto backend without checking that the destination dynptr was at least as large, so a crafted BPF program could write past the end of the destination buffer in kernel memory. On a GPU node that means kernel heap corruption, which realistically ends in a host crash or privilege escalation from whatever context loaded the program - and a crashing GPU host takes its running jobs with it and is expensive to drain. The practical exposure is narrow: the upstream fix notes these kfuncs are reachable only with root privileges, so this is a hardening fix rather than a tenant-reachable escape. Fleets that let an agent or operator load BPF programs as root (CNI dataplanes, eBPF observability agents) are the ones that should care.

Who can reach it

Local, root-privileged: an actor able to load a BPF program that calls the crypto kfuncs. Not reachable from an unprivileged tenant pod, and not reachable over the network.

What to do

Take the stable kernel update containing the added src_len > dst_len check (commits linked in the record); there is no runtime mitigation other than not loading untrusted BPF. Applying it means a kernel package upgrade, so each GPU node has to be drained and rebooted - batch it with the next routine kernel window rather than opening one for this alone, given the root-only precondition.

References

Related entries

• Linux kernel io_uring: io_link_skb compares a notification against itself, skipping the context validation checkCVE-2025-39963 · Linux kernel io_uring zero-copy send (io_link_skb notification context check)High
• Linux kernel (net/xfrm): SPI 0 means 'no SPI assigned', but the duplicate-SPI rework started creating states with SPI 0CVE-2025-39965 · Linux kernel (net/xfrm)High
• Linux kernel (drivers/iommu/iommufd): Aborting an iommufd object allocation freed the object immediately while theCVE-2025-39966 · Linux kernel (drivers/iommu/iommufd)High
• Linux kernel mlx5_core flow steering / flow counters (hardware steering): Use-after-free releasingCVE-2025-39979 · Linux kernel mlx5_core flow steering / flow counters (hardware steering)High
• Linux kernel BPF verifier: get_helper_proto dereferences a NULL helper function pointer when a config option is disabledCVE-2025-39990 · Linux kernel BPF verifier (get_helper_proto NULL helper pointer)High
• Linux kernel hugetlbfs: fallocate hole-punch races page migration and corrupts page accountingCVE-2025-40006 · Linux kernel hugetlbfs (remove_inode_single_folio folio-lock race)High