CVE-2025-38012

sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator

published June 18, 2025

CVSS
—
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator

BPF programs may call next() and destroy() on BPF iterators even after new()

returns an error value (e.g. bpf_for_each() macro ignores error returns from

new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized

state after an error return causing bpf_iter_scx_dsq_next() to dereference

garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that

next() and destroy() become noops.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.8th percentile
Published
2025-06-18T09:28Z
EPSS history
Timeline
  • 18 JUN 09:28Z
    sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
    cvelistv5