Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.
INFO
Published Date :
2025-08-16T11:12:21.667Z
Last Modified :
2025-11-03T17:39:24.864Z
Source :
Linux
AFFECTED PRODUCTS
The following products are affected by CVE-2025-38528 vulnerability.
| Vendors | Products |
|---|---|
| Debian |
|
| Linux |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-38528.
