In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix fp initialization for exception boundary
In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a program acting as exception boundary, all callee saved registers are saved. find_used_callee_regs() sets `ctx->fp_used = true;` when it sees FP being used in any of the instructions.
For programs acting as exception boundary, ctx->fp_used remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault.
Fix it by setting ctx->fp_used = true for exception boundary programs as fp is always saved in such programs.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool6.12-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12Upgrade bpftool6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-libbpf-develUpgrade kernel6.12-libbpf-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-tools-develUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-headersUpgrade kernel6.12-toolsUpgrade kernel6.12-libbpfUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-debuginfoUpgrade perf6.12 | Sep 30, 2025 | Aug 19, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2025 | Aug 19, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Aug 19, 2025 |
| Suse | — | Upgrade kernel-rt-optionalUpgrade kernel-docs-htmlUpgrade dtb-allwinnerUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-docsUpgrade dtb-socionextUpgrade cluster-md-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-rockchipUpgrade kernel-develUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade dtb-alteraUpgrade kernel-rt-livepatchUpgrade kselftests-kmp-rtUpgrade kernel-rt-vdsoUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-source-vanillaUpgrade dtb-xilinxUpgrade dtb-appleUpgrade kernel-default-optionalUpgrade dtb-caviumUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-broadcomUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dtb-sprdUpgrade kernel-rt-extraUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-symsUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade dtb-exynosUpgrade dtb-amazonUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-kvmsmallUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade dtb-marvellUpgrade kernel-default-livepatchUpgrade kernel-sourceUpgrade ocfs2-kmp-rtUpgrade kernel-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade kselftests-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-hisiliconUpgrade kernel-kvmsmall-develUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade kernel-default-extraUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-macros | Dec 5, 2025 | Nov 6, 2025 |
| Ubuntu | — | Upgrade linux-image-aws-64k-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-realtime-6.14Upgrade linux-image-awsUpgrade linux-image-aws-6.14Upgrade linux-image-raspi-6.14Upgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-oem-24.04aUpgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-gcpUpgrade linux-image-virtual-6.14Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-aws-64kUpgrade linux-image-raspiUpgrade linux-image-generic-64k-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-azureUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-genericUpgrade linux-image-oem-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-azure-6.14Upgrade linux-image-generic-64k | Nov 25, 2025 | Nov 21, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub