Threats tagged 'ghsa-99r2-xh56-23cv'

CVE-2025-38012 is a medium severity vulnerability in the Linux kernel's BPF iterator implementation. The function bpf_iter_scx_dsq_new() may leave an iterator uninitialized after returning an error, leading to potential dereferencing of garbage data in subsequent calls to next() or destroy(). This occurs because some BPF programs call next() and destroy() even if new() returns an error, and the bpf_for_each() macro ignores these error returns. The issue has been resolved by ensuring bpf_iter_scx_dsq_new() always clears the iterator state on error.