Skip to content
OpenAdvisories
High · 7.8 CVE-2025-38339 EUVD-2025-20907GHSA-pcqg-8r4j-p55f

powerpc/bpf: fix JIT code size calculation of bpf trampoline

Published Jul 10, 2025 · Updated Aug 5, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-nvidia-6.14 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.14 Package: linux-oem-6.5 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/bpf: fix JIT code size calculation of bpf trampoline

arch_bpf_trampoline_size() provides JIT size of the BPF trampoline
before the buffer for JIT'ing it is allocated. The total number of
instructions emitted for BPF trampoline JIT code depends on where
the final image is located. So, the size arrived at with the dummy
pass in arch_bpf_trampoline_size() can vary from the actual size
needed in arch_prepare_bpf_trampoline(). When the instructions
accounted in arch_bpf_trampoline_size() is less than the number of
instructions emitted during the actual JIT compile of the trampoline,
the below warning is produced:

WARNING: CPU: 8 PID: 204190 at arch/powerpc/net/bpf_jit_comp.c:981 __arch_prepare_bpf_trampoline.isra.0+0xd2c/0xdcc

which is:

/* Make sure the trampoline generation logic doesn't overflow */
if (image && WARN_ON_ONCE(&image[ctx->idx] >
(u32 *)rw_image_end - BPF_INSN_SAFETY)) {

So, during the dummy pass, instead of providing some arbitrary image
location, account for maximum possible instructions if and when there
is a dependency with image location for JIT'ing.

Affected products

VendorProductAffectedFixed
Linux Linux 6.13 6.15.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 25.10 linux-azure-fde No fix yet —
Ubuntu 24.04 LTS linux-aws-6.14 +1 6.14.0-1015.15~24.04.1 USN-7833-3, USN-7833-1
Ubuntu 24.04 LTS linux-azure-6.14 6.14.0-1014.14~24.04.1 USN-7834-1
Ubuntu 24.04 LTS linux-azure-nvidia-6.14 6.14.0-1007.7 USN-7834-1
Ubuntu 24.04 LTS linux-gcp-6.14 6.14.0-1018.19~24.04.1 USN-7833-4
Ubuntu 24.04 LTS linux-hwe-6.14 6.14.0-34.34~24.04.1 USN-7856-1
Ubuntu 24.04 LTS linux-oem-6.14 6.14.0-1014.14 USN-7833-1
Ubuntu 24.04 LTS linux-riscv +6 No fix yet —
Ubuntu 24.04 LTS linux-riscv-6.14 6.14.0-34.34.1~24.04.1 —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 6.14.0-1014.14~24.04.1 USN-7833-2
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 kernel-64kb +7 6.12.0-160000.6.1 SUSE-SU-2025:21139-1
SLES for SAP 16.0 kernel-default-base 6.12.0-160000.6.1.160000.2.4 SUSE-SU-2025:21139-1
SLES 16.0 kernel-64kb +7 6.12.0-160000.6.1 SUSE-SU-2025:21179-1, SUSE-SU-2025:21139-1
SLES 16.0 kernel-default-base 6.12.0-160000.6.1.160000.2.4 SUSE-SU-2025:21139-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.6.1.160000.2.4 SUSE-SU-2025:21074-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.6.1 SUSE-SU-2026:20560-1, SUSE-SU-2025:21074-1
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.6.1.160000.2.4 openSUSE-SU-2025:20081-1
openSUSE Leap 16.0 kernel-rt +10 6.12.0-160000.6.1 openSUSE-SU-2025:20081-1

Advisories 12

References