CVE-2025-38060: backport fix series
Status from this message: Queued for 6.6, thanks.
Get series with b4
b4 am [email protected]Versions newest first
Patches in v1 Applied
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | bpf: copy_verifier_state() should copy 'loop_entry' fieldkernel/ | +3 | 0 replies | |
| 2/2 | bpf: abort verification if env->cur_state->loop_entry != NULLkernel/ | +4 | 1 reply |
Reviews trailers per patch
1 of 2 patches has a Reviewed-by or Acked-by.
| Patch | Andrii Nakryiko |
|---|---|
| 1/2 | |
| 2/2 | A-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH 6.6.y 0/2] CVE-2025-38060: backport fix series
Hi,
Please consider this backport series for CVE-2025-38060 to 6.6.y.
Apply the patches in this order:
1. bpf: copy_verifier_state() should copy 'loop_entry' field (fix)
2. bpf: abort verification if env->cur_state->loop_entry != NULL (correction)
Patch 1 preserves loop_entry when copying verifier state, keeping cloned loop states consistent with their originals.
Patch 2 aborts verification with -EFAULT when loop_entry is unexpectedly set instead of clearing the pointer and continuing with corrupted state. The code changes in both patches are identical to upstream.
The complete fix is already present in 6.12.y, 6.18.y and 7.2.y.
Build-tested only as part of a cumulative 6.6.y series on x86_64 (allmodconfig, CONFIG_WERROR=y); no runtime testing.
An LLM assisted with preparing these backports.
Thanks,
Artem Dinaburg