In the Linux kernel, the following vulnerability has been resolved:
perf: Revert to requiring CAPSYSADMIN for uprobes
Jann reports that uprobes can be used destructively when used in the middle of an instruction. The kernel only verifies there is a valid instruction at the requested offset, but due to variable instruction length cannot determine if this is an instruction as seen by the intended execution stream.
Additionally, Mark Rutland notes that on architectures that mix data in the text segment (like arm64), a similar things can be done if the data word is 'mistaken' for an instruction.
As such, require CAPSYSADMIN for uprobes.
[
{
"id": "CVE-2025-38466-10f502b7",
"deprecated": false,
"digest": {
"line_hashes": [
"203171045716701562097029266400071303418",
"33188364481081891234079540105273433503",
"136367193207538915061359326799161332263",
"172019851605817209672699040105790821841"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ef1afd5b3f43f4924326164cee5397b66abd9c",
"signature_type": "Line"
},
{
"id": "CVE-2025-38466-21603982",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "325710012138882182365020880996555458215"
},
"signature_version": "v1",
"target": {
"function": "perf_uprobe_event_init",
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ef1afd5b3f43f4924326164cee5397b66abd9c",
"signature_type": "Function"
},
{
"id": "CVE-2025-38466-2454c0fb",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "325710012138882182365020880996555458215"
},
"signature_version": "v1",
"target": {
"function": "perf_uprobe_event_init",
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5074256b642cdeb46a70ce2f15193e766edca68",
"signature_type": "Function"
},
{
"id": "CVE-2025-38466-31d1404b",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "325710012138882182365020880996555458215"
},
"signature_version": "v1",
"target": {
"function": "perf_uprobe_event_init",
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0aec35f861fa746ca45aa816161c74352e6ada8",
"signature_type": "Function"
},
{
"id": "CVE-2025-38466-58ab41af",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "325710012138882182365020880996555458215"
},
"signature_version": "v1",
"target": {
"function": "perf_uprobe_event_init",
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a8009083e569b5526c64f7d3f2a62baca95164",
"signature_type": "Function"
},
{
"id": "CVE-2025-38466-7338124f",
"deprecated": false,
"digest": {
"line_hashes": [
"203171045716701562097029266400071303418",
"33188364481081891234079540105273433503",
"136367193207538915061359326799161332263",
"172019851605817209672699040105790821841"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a8009083e569b5526c64f7d3f2a62baca95164",
"signature_type": "Line"
},
{
"id": "CVE-2025-38466-84b71578",
"deprecated": false,
"digest": {
"line_hashes": [
"203171045716701562097029266400071303418",
"33188364481081891234079540105273433503",
"136367193207538915061359326799161332263",
"172019851605817209672699040105790821841"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e8bf7bc6aa6f583336c2fda280b6cea0aed5612",
"signature_type": "Line"
},
{
"id": "CVE-2025-38466-a29afd62",
"deprecated": false,
"digest": {
"line_hashes": [
"203171045716701562097029266400071303418",
"33188364481081891234079540105273433503",
"136367193207538915061359326799161332263",
"172019851605817209672699040105790821841"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0aec35f861fa746ca45aa816161c74352e6ada8",
"signature_type": "Line"
},
{
"id": "CVE-2025-38466-cb0cd8f3",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "325710012138882182365020880996555458215"
},
"signature_version": "v1",
"target": {
"function": "perf_uprobe_event_init",
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@183bdb89af1b5193b1d1d9316986053b15ca6fa4",
"signature_type": "Function"
},
{
"id": "CVE-2025-38466-ce128054",
"deprecated": false,
"digest": {
"line_hashes": [
"203171045716701562097029266400071303418",
"33188364481081891234079540105273433503",
"136367193207538915061359326799161332263",
"172019851605817209672699040105790821841"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5074256b642cdeb46a70ce2f15193e766edca68",
"signature_type": "Line"
},
{
"id": "CVE-2025-38466-dcb8af77",
"deprecated": false,
"digest": {
"length": 489.0,
"function_hash": "325710012138882182365020880996555458215"
},
"signature_version": "v1",
"target": {
"function": "perf_uprobe_event_init",
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e8bf7bc6aa6f583336c2fda280b6cea0aed5612",
"signature_type": "Function"
},
{
"id": "CVE-2025-38466-e0c35d2b",
"deprecated": false,
"digest": {
"line_hashes": [
"203171045716701562097029266400071303418",
"33188364481081891234079540105273433503",
"136367193207538915061359326799161332263",
"172019851605817209672699040105790821841"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "kernel/events/core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@183bdb89af1b5193b1d1d9316986053b15ca6fa4",
"signature_type": "Line"
}
]