Format String Vulnerability in Linux Kernel Affects BPF Trace Functionality

CVE-2025-38528

What is CVE-2025-38528?

A format string vulnerability in the Linux kernel's BPF functions allows for improper handling of input resulting in kernel warnings. Specifically, the bpf_trace_printk function fails to reject an unsupported format string that contains multiple '%' characters. This oversight can lead to runtime warnings as the BPF program fails to process the input correctly, risking system stability. A patch has been applied to ensure that such format strings are appropriately rejected, enhancing the robustness of BPF functionalities.

References