CVE-2025-38060

一、漏洞信息
 漏洞编号：[CVE-2025-38060](https://nvd.nist.gov/vuln/detail/CVE-2025-38060)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. There is a security vulnerability in Linux kernel, which originates from the fact that the loop_entry field is not copied by the bpf validator, causing state pollution.
 漏洞公开时间：2025-06-18 18:15:38
 漏洞创建时间：2025-06-19 11:37:06
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-38060
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-38060 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2373365 |  |
|  | https://access.redhat.com/security/cve/CVE-2025-38060 |  |
|  | https://www.suse.com/security/cve/CVE-2025-38060.html |  |
|  | https://bugzilla.suse.com/1245155 |  |
|  | https://bugzilla.suse.com/1245156 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | https://www.suse.com/security/cve/CVE-2025-38060.html |  |
|  | https://bugzilla.suse.com/1245155 |  |
|  | https://bugzilla.suse.com/1245156 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | https://www.suse.com/security/cve/CVE-2025-38060.html |  |
|  | https://bugzilla.suse.com/1245155 |  |
|  | https://bugzilla.suse.com/1245156 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | https://www.suse.com/security/cve/CVE-2025-38060.html |  |
|  | https://bugzilla.suse.com/1245155 |  |
|  | https://bugzilla.suse.com/1245156 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | https://www.suse.com/security/cve/CVE-2025-38060.html |  |
|  | https://bugzilla.suse.com/1245155 |  |
|  | https://bugzilla.suse.com/1245156 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38060 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38060 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38060 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |
|  | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-38060 |  |
|  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  |
|  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  |
|  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/bbbc02b7445ebfda13e4847f4f1413c6480a85a9.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  | nvd |
|  |  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  | nvd |
|  |  | https://git.kernel.org/stable/c/46ba5757a7a4714e7d3f68cfe118208822cb3d78 |  | snyk |
|  |  | https://git.kernel.org/stable/c/8b4afd89fa75f738a80ca849126fd3cad77bcbf1 |  | snyk |
|  |  | https://git.kernel.org/stable/c/bbbc02b7445ebfda13e4847f4f1413c6480a85a9 |  | snyk |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:bpf: copy_verifier_state() should copy  loop_entry  fieldThe bpf_verifier_state.loop_entry state should be copied bycopy_verifier_state(). Otherwise, .loop_entry values from unrelatedstates would poison env->cur_state.Additionally, env->stack should not contain any states with.loop_entry != NULL. The states in env->stack are yet to be verified,while .loop_entry is set for states that reached an equivalent state.This means that env->cur_state->loop_entry should always be NULL afterpop_stack().See the selftest in the next commit for an example of the program thatis not safe yet is accepted by verifier w/o this fix.This change has some verification performance impact for selftests:File                                Program                       Insns (A)  Insns (B)  Insns   (DIFF)  States (A)  States (B)  States (DIFF)----------------------------------  ----------------------------  ---------  ---------  --------------  ----------  ----------  -------------arena_htab.bpf.o                    arena_htab_llvm                     717        426  -291 (-40.59%)          57          37  -20 (-35.09%)arena_htab_asm.bpf.o                arena_htab_asm                      597        445  -152 (-25.46%)          47          37  -10 (-21.28%)arena_list.bpf.o                    arena_list_del                      309        279    -30 (-9.71%)          23          14   -9 (-39.13%)iters.bpf.o                         iter_subprog_check_stacksafe        155        141    -14 (-9.03%)          15          14    -1 (-6.67%)iters.bpf.o                         iter_subprog_iters                 1094       1003    -91 (-8.32%)          88          83    -5 (-5.68%)iters.bpf.o                         loop_state_deps2                    479        725  +246 (+51.36%)          46          63  +17 (+36.96%)kmem_cache_iter.bpf.o               open_coded_iter                      63         59     -4 (-6.35%)           7           6   -1 (-14.29%)verifier_bits_iter.bpf.o            max_words                            92         84     -8 (-8.70%)           8           7   -1 (-12.50%)verifier_iterating_callbacks.bpf.o  cond_break2                         113        107     -6 (-5.31%)          12          12    +0 (+0.00%)And significant negative impact for sched_ext:File               Program                 Insns (A)  Insns (B)  Insns         (DIFF)  States (A)  States (B)  States      (DIFF)-----------------  ----------------------  ---------  ---------  --------------------  ----------  ----------  ------------------bpf.bpf.o          lavd_init                    7039      14723      +7684 (+109.16%)         490        1139     +649 (+132.45%)bpf.bpf.o          layered_dispatch            11485      10548         -937 (-8.16%)         848         762       -86 (-10.14%)bpf.bpf.o          layered_dump                 7422    1000001  +992579 (+13373.47%)         681       31178  +30497 (+4478.27%)bpf.bpf.o          layered_enqueue             16854      71127     +54273 (+322.02%)        1611        6450    +4839 (+300.37%)bpf.bpf.o          p2dq_dispatch                 665        791        +126 (+18.95%)          68          78       +10 (+14.71%)bpf.bpf.o          p2dq_init                    2343       2980        +637 (+27.19%)         201         237       +36 (+17.91%)bpf.bpf.o          refresh_layer_cpumasks      16487     674760   +658273 (+3992.68%)        1770       65370  +63600 (+3593.22%)bpf.bpf.o          rusty_select_cpu             1937      40872    +38935 (+2010.07%)         177        3210   +3033 (+1713.56%)scx_central.bpf.o  central_dispatch              636       2687      +2051 (+322.48%)          63         227     +164 (+260.32%)scx_nest.bpf.o     nest_init                     636        815        +179 (+28.14%)          60          73       +13 (+21.67%)scx_qmap.bpf.o     qmap_dispatch      ---truncated---
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-24.03-LTS(6.6.0):受影响
2.openEuler-24.03-LTS-SP1(6.6.0):受影响
3.openEuler-24.03-LTS-SP2(6.6.0):受影响
4.openEuler-20.03-LTS-SP4(4.19.90):不受影响
5.openEuler-22.03-LTS-SP3(5.10.0):不受影响
6.openEuler-22.03-LTS-SP4(5.10.0):不受影响
7.master(6.12.33):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.12.33):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
7.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
8.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1870

src-openEuler/kernel

Content Risk Flag

Comments (10)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-38060

Comments (10)

Search

src-openEuler/kernel