{"id":"DEBIAN-CVE-2025-38640","details":"In the Linux kernel, the following vulnerability has been resolved:  bpf: Disable migration in nf_hook_run_bpf().  syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path.  Then the assertion in __bpf_prog_run() fails, triggering the splat below. [0]  Let's use bpf_prog_run_pin_on_cpu() in nf_hook_run_bpf().  [0]: BUG: assuming non migratable context at ./include/linux/filter.h:703 in_atomic(): 0, irqs_disabled(): 0, migration_disabled() 0 pid: 5829, name: sshd-session 3 locks held by sshd-session/5829:  #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline]  #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 net/ipv4/tcp.c:1395  #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]  #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]  #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x26c0 net/ipv4/ip_output.c:470  #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]  #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]  #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: nf_hook+0xb2/0x680 include/linux/netfilter.h:241 CPU: 0 UID: 0 PID: 5829 Comm: sshd-session Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace:  \u003cTASK\u003e  __dump_stack lib/dump_stack.c:94 [inline]  dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120  __cant_migrate kernel/sched/core.c:8860 [inline]  __cant_migrate+0x1c7/0x250 kernel/sched/core.c:8834  __bpf_prog_run include/linux/filter.h:703 [inline]  bpf_prog_run include/linux/filter.h:725 [inline]  nf_hook_run_bpf+0x83/0x1e0 net/netfilter/nf_bpf_link.c:20  nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]  nf_hook_slow+0xbb/0x200 net/netfilter/core.c:623  nf_hook+0x370/0x680 include/linux/netfilter.h:272  NF_HOOK_COND include/linux/netfilter.h:305 [inline]  ip_output+0x1bc/0x2a0 net/ipv4/ip_output.c:433  dst_output include/net/dst.h:459 [inline]  ip_local_out net/ipv4/ip_output.c:129 [inline]  __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527  __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479  tcp_transmit_skb net/ipv4/tcp_output.c:1497 [inline]  tcp_write_xmit+0x1274/0x84e0 net/ipv4/tcp_output.c:2838  __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3021  tcp_push+0x225/0x700 net/ipv4/tcp.c:759  tcp_sendmsg_locked+0x1870/0x42b0 net/ipv4/tcp.c:1359  tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1396  inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851  sock_sendmsg_nosec net/socket.c:712 [inline]  __sock_sendmsg net/socket.c:727 [inline]  sock_write_iter+0x4aa/0x5b0 net/socket.c:1131  new_sync_write fs/read_write.c:593 [inline]  vfs_write+0x6c7/0x1150 fs/read_write.c:686  ksys_write+0x1f8/0x250 fs/read_write.c:738  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe7d365d407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 \u003c5b\u003e c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP:","modified":"2026-08-27T23:05:30.386159805Z","published":"2025-08-22T16:15:38.007Z","upstream":["CVE-2025-38640"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38640"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.43-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1~bpo12+1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38640.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.16.3-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.3-1~bpo13+1","6.16~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38640.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}