Bug 1250723 (CVE-2025-39917) - VUL-0: CVE-2025-39917: kernel: bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
Summary: VUL-0: CVE-2025-39917: kernel: bpf: Fix out-of-bounds dynptr write in bpf_cry...
Status: NEW
Alias: CVE-2025-39917
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/475106/
Whiteboard: CVSSv3.1:SUSE:CVE-2025-39917:4.4:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2025-10-01 12:11 UTC by SMASH SMASH
Modified: 2026-04-02 18:15 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2025-10-01 12:11:58 UTC 
In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt

Stanislav reported that in bpf_crypto_crypt() the destination dynptr's
size is not validated to be at least as large as the source dynptr's
size before calling into the crypto backend with 'len = src_len'. This
can result in an OOB write when the destination is smaller than the
source.

Concretely, in mentioned function, psrc and pdst are both linear
buffers fetched from each dynptr:

  psrc = __bpf_dynptr_data(src, src_len);
  [...]
  pdst = __bpf_dynptr_data_rw(dst, dst_len);
  [...]
  err = decrypt ?
        ctx->type->decrypt(ctx->tfm, psrc, pdst, src_len, piv) :
        ctx->type->encrypt(ctx->tfm, psrc, pdst, src_len, piv);

The crypto backend expects pdst to be large enough with a src_len length
that can be written. Add an additional src_len > dst_len check and bail
out if it's the case. Note that these kfuncs are accessible under root
privileges only.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-39917
https://www.cve.org/CVERecord?id=CVE-2025-39917
https://git.kernel.org/stable/c/0126358df12d6f476f79251d9c398ac5c1b3062d
https://git.kernel.org/stable/c/c4be24ef0510c146dca4671effb127e97631534b
https://git.kernel.org/stable/c/f9bb6ffa7f5ad0f8ee0f53fc4a10655872ee4a14
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2025/CVE-2025-39917.mbox
Comment 4 Maintenance Automation 2026-01-09 16:30:32 UTC 
SUSE-SU-2026:20012-1: An update that solves 100 vulnerabilities, contains five features and has 19 fixes can now be installed.

URL: https://www.suse.com/support/update/announcement/2026/suse-su-202620012-1
Category: security (important)
Bug References: 1235463, 1243474, 1245193, 1245431, 1245498, 1245499, 1246328, 1246843, 1247500, 1248792, 1249256, 1249397, 1249912, 1249977, 1249982, 1250034, 1250176, 1250237, 1250252, 1250705, 1250723, 1250746, 1251120, 1251817, 1252054, 1252063, 1252301, 1252303, 1252342, 1252352, 1252357, 1252681, 1252686, 1252763, 1252776, 1252779, 1252790, 1252794, 1252795, 1252808, 1252809, 1252817, 1252821, 1252824, 1252836, 1252845, 1252901, 1252912, 1252917, 1252919, 1252923, 1252928, 1253018, 1253155, 1253176, 1253238, 1253275, 1253318, 1253324, 1253328, 1253330, 1253342, 1253348, 1253349, 1253352, 1253355, 1253360, 1253362, 1253363, 1253367, 1253369, 1253386, 1253394, 1253395, 1253402, 1253403, 1253405, 1253407, 1253408, 1253409, 1253410, 1253412, 1253416, 1253421, 1253422, 1253423, 1253424, 1253425, 1253426, 1253427, 1253428, 1253431, 1253433, 1253436, 1253438, 1253440, 1253441, 1253443, 1253445, 1253448, 1253449, 1253450, 1253451, 1253453, 1253455, 1253456, 1253457, 1253463, 1253472, 1253622, 1253624, 1253635, 1253643, 1253647, 1254119, 1254181, 1254221, 1254308, 1254315
CVE References: CVE-2022-50253, CVE-2025-37916, CVE-2025-38084, CVE-2025-38085, CVE-2025-38321, CVE-2025-38728, CVE-2025-39805, CVE-2025-39819, CVE-2025-39822, CVE-2025-39831, CVE-2025-39859, CVE-2025-39897, CVE-2025-39917, CVE-2025-39944, CVE-2025-39961, CVE-2025-39980, CVE-2025-39990, CVE-2025-40001, CVE-2025-40003, CVE-2025-40006, CVE-2025-40021, CVE-2025-40024, CVE-2025-40027, CVE-2025-40031, CVE-2025-40033, CVE-2025-40038, CVE-2025-40047, CVE-2025-40053, CVE-2025-40055, CVE-2025-40059, CVE-2025-40064, CVE-2025-40070, CVE-2025-40074, CVE-2025-40075, CVE-2025-40081, CVE-2025-40083, CVE-2025-40086, CVE-2025-40098, CVE-2025-40101, CVE-2025-40102, CVE-2025-40105, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40127, CVE-2025-40129, CVE-2025-40132, CVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40139, CVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40149, CVE-2025-40153, CVE-2025-40154, CVE-2025-40156, CVE-2025-40157, CVE-2025-40158, CVE-2025-40159, CVE-2025-40161, CVE-2025-40162, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40168, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40175, CVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40180, CVE-2025-40183, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40194, CVE-2025-40196, CVE-2025-40197, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207
Jira References: PED-13611, PED-13949, PED-14062, PED-14115, PED-14353
Sources used:
SUSE Linux Micro 6.2 (src):
 kernel-default-base-6.12.0-160000.8.1.160000.2.5, kernel-source-6.12.0-160000.8.1
SUSE Linux Micro Extras 6.2 (src):
 kernel-obs-build-6.12.0-160000.8.1, kernel-syms-6.12.0-160000.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 5 Maintenance Automation 2026-01-09 20:30:19 UTC 
SUSE-SU-2026:20021-1: An update that solves 100 vulnerabilities, contains five features and has 19 fixes can now be installed.

URL: https://www.suse.com/support/update/announcement/2026/suse-su-202620021-1
Category: security (important)
Bug References: 1235463, 1243474, 1245193, 1245431, 1245498, 1245499, 1246328, 1246843, 1247500, 1248792, 1249256, 1249397, 1249912, 1249977, 1249982, 1250034, 1250176, 1250237, 1250252, 1250705, 1250723, 1250746, 1251120, 1251817, 1252054, 1252063, 1252301, 1252303, 1252342, 1252352, 1252357, 1252681, 1252686, 1252763, 1252776, 1252779, 1252790, 1252794, 1252795, 1252808, 1252809, 1252817, 1252821, 1252824, 1252836, 1252845, 1252901, 1252912, 1252917, 1252919, 1252923, 1252928, 1253018, 1253155, 1253176, 1253238, 1253275, 1253318, 1253324, 1253328, 1253330, 1253342, 1253348, 1253349, 1253352, 1253355, 1253360, 1253362, 1253363, 1253367, 1253369, 1253386, 1253394, 1253395, 1253402, 1253403, 1253405, 1253407, 1253408, 1253409, 1253410, 1253412, 1253416, 1253421, 1253422, 1253423, 1253424, 1253425, 1253426, 1253427, 1253428, 1253431, 1253433, 1253436, 1253438, 1253440, 1253441, 1253443, 1253445, 1253448, 1253449, 1253450, 1253451, 1253453, 1253455, 1253456, 1253457, 1253463, 1253472, 1253622, 1253624, 1253635, 1253643, 1253647, 1254119, 1254181, 1254221, 1254308, 1254315
CVE References: CVE-2022-50253, CVE-2025-37916, CVE-2025-38084, CVE-2025-38085, CVE-2025-38321, CVE-2025-38728, CVE-2025-39805, CVE-2025-39819, CVE-2025-39822, CVE-2025-39831, CVE-2025-39859, CVE-2025-39897, CVE-2025-39917, CVE-2025-39944, CVE-2025-39961, CVE-2025-39980, CVE-2025-39990, CVE-2025-40001, CVE-2025-40003, CVE-2025-40006, CVE-2025-40021, CVE-2025-40024, CVE-2025-40027, CVE-2025-40031, CVE-2025-40033, CVE-2025-40038, CVE-2025-40047, CVE-2025-40053, CVE-2025-40055, CVE-2025-40059, CVE-2025-40064, CVE-2025-40070, CVE-2025-40074, CVE-2025-40075, CVE-2025-40081, CVE-2025-40083, CVE-2025-40086, CVE-2025-40098, CVE-2025-40101, CVE-2025-40102, CVE-2025-40105, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40127, CVE-2025-40129, CVE-2025-40132, CVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40139, CVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40149, CVE-2025-40153, CVE-2025-40154, CVE-2025-40156, CVE-2025-40157, CVE-2025-40158, CVE-2025-40159, CVE-2025-40161, CVE-2025-40162, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40168, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40175, CVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40180, CVE-2025-40183, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40194, CVE-2025-40196, CVE-2025-40197, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207
Jira References: PED-13611, PED-13949, PED-14062, PED-14115, PED-14353
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Maintenance Automation 2026-01-09 20:32:01 UTC 
SUSE-SU-2026:20015-1: An update that solves 100 vulnerabilities, contains five features and has 19 fixes can now be installed.

URL: https://www.suse.com/support/update/announcement/2026/suse-su-202620015-1
Category: security (important)
Bug References: 1235463, 1243474, 1245193, 1245431, 1245498, 1245499, 1246328, 1246843, 1247500, 1248792, 1249256, 1249397, 1249912, 1249977, 1249982, 1250034, 1250176, 1250237, 1250252, 1250705, 1250723, 1250746, 1251120, 1251817, 1252054, 1252063, 1252301, 1252303, 1252342, 1252352, 1252357, 1252681, 1252686, 1252763, 1252776, 1252779, 1252790, 1252794, 1252795, 1252808, 1252809, 1252817, 1252821, 1252824, 1252836, 1252845, 1252901, 1252912, 1252917, 1252919, 1252923, 1252928, 1253018, 1253155, 1253176, 1253238, 1253275, 1253318, 1253324, 1253328, 1253330, 1253342, 1253348, 1253349, 1253352, 1253355, 1253360, 1253362, 1253363, 1253367, 1253369, 1253386, 1253394, 1253395, 1253402, 1253403, 1253405, 1253407, 1253408, 1253409, 1253410, 1253412, 1253416, 1253421, 1253422, 1253423, 1253424, 1253425, 1253426, 1253427, 1253428, 1253431, 1253433, 1253436, 1253438, 1253440, 1253441, 1253443, 1253445, 1253448, 1253449, 1253450, 1253451, 1253453, 1253455, 1253456, 1253457, 1253463, 1253472, 1253622, 1253624, 1253635, 1253643, 1253647, 1254119, 1254181, 1254221, 1254308, 1254315
CVE References: CVE-2022-50253, CVE-2025-37916, CVE-2025-38084, CVE-2025-38085, CVE-2025-38321, CVE-2025-38728, CVE-2025-39805, CVE-2025-39819, CVE-2025-39822, CVE-2025-39831, CVE-2025-39859, CVE-2025-39897, CVE-2025-39917, CVE-2025-39944, CVE-2025-39961, CVE-2025-39980, CVE-2025-39990, CVE-2025-40001, CVE-2025-40003, CVE-2025-40006, CVE-2025-40021, CVE-2025-40024, CVE-2025-40027, CVE-2025-40031, CVE-2025-40033, CVE-2025-40038, CVE-2025-40047, CVE-2025-40053, CVE-2025-40055, CVE-2025-40059, CVE-2025-40064, CVE-2025-40070, CVE-2025-40074, CVE-2025-40075, CVE-2025-40081, CVE-2025-40083, CVE-2025-40086, CVE-2025-40098, CVE-2025-40101, CVE-2025-40102, CVE-2025-40105, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40127, CVE-2025-40129, CVE-2025-40132, CVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40139, CVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40149, CVE-2025-40153, CVE-2025-40154, CVE-2025-40156, CVE-2025-40157, CVE-2025-40158, CVE-2025-40159, CVE-2025-40161, CVE-2025-40162, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40168, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40175, CVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40180, CVE-2025-40183, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40194, CVE-2025-40196, CVE-2025-40197, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207
Jira References: PED-13611, PED-13949, PED-14062, PED-14115, PED-14353
Sources used:
SUSE Linux Enterprise Server 16.0 (src):
 kernel-syms-6.12.0-160000.8.1, kernel-default-base-6.12.0-160000.8.1.160000.2.5, kernel-source-6.12.0-160000.8.1, kernel-obs-qa-6.12.0-160000.8.1
SUSE Linux Enterprise Server for SAP Applications 16.0 (src):
 kernel-syms-6.12.0-160000.8.1, kernel-default-base-6.12.0-160000.8.1.160000.2.5, kernel-source-6.12.0-160000.8.1, kernel-obs-qa-6.12.0-160000.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2026-03-05 12:44:16 UTC 
SUSE-SU-2026:20562-1: An update that solves 100 vulnerabilities, contains five features and has 19 fixes can now be installed.

URL: https://www.suse.com/support/update/announcement/2026/suse-su-202620562-1
Category: security (important)
Bug References: 1235463, 1243474, 1245193, 1245431, 1245498, 1245499, 1246328, 1246843, 1247500, 1248792, 1249256, 1249397, 1249912, 1249977, 1249982, 1250034, 1250176, 1250237, 1250252, 1250705, 1250723, 1250746, 1251120, 1251817, 1252054, 1252063, 1252301, 1252303, 1252342, 1252352, 1252357, 1252681, 1252686, 1252763, 1252776, 1252779, 1252790, 1252794, 1252795, 1252808, 1252809, 1252817, 1252821, 1252824, 1252836, 1252845, 1252901, 1252912, 1252917, 1252919, 1252923, 1252928, 1253018, 1253155, 1253176, 1253238, 1253275, 1253318, 1253324, 1253328, 1253330, 1253342, 1253348, 1253349, 1253352, 1253355, 1253360, 1253362, 1253363, 1253367, 1253369, 1253386, 1253394, 1253395, 1253402, 1253403, 1253405, 1253407, 1253408, 1253409, 1253410, 1253412, 1253416, 1253421, 1253422, 1253423, 1253424, 1253425, 1253426, 1253427, 1253428, 1253431, 1253433, 1253436, 1253438, 1253440, 1253441, 1253443, 1253445, 1253448, 1253449, 1253450, 1253451, 1253453, 1253455, 1253456, 1253457, 1253463, 1253472, 1253622, 1253624, 1253635, 1253643, 1253647, 1254119, 1254181, 1254221, 1254308, 1254315
CVE References: CVE-2022-50253, CVE-2025-37916, CVE-2025-38084, CVE-2025-38085, CVE-2025-38321, CVE-2025-38728, CVE-2025-39805, CVE-2025-39819, CVE-2025-39822, CVE-2025-39831, CVE-2025-39859, CVE-2025-39897, CVE-2025-39917, CVE-2025-39944, CVE-2025-39961, CVE-2025-39980, CVE-2025-39990, CVE-2025-40001, CVE-2025-40003, CVE-2025-40006, CVE-2025-40021, CVE-2025-40024, CVE-2025-40027, CVE-2025-40031, CVE-2025-40033, CVE-2025-40038, CVE-2025-40047, CVE-2025-40053, CVE-2025-40055, CVE-2025-40059, CVE-2025-40064, CVE-2025-40070, CVE-2025-40074, CVE-2025-40075, CVE-2025-40081, CVE-2025-40083, CVE-2025-40086, CVE-2025-40098, CVE-2025-40101, CVE-2025-40102, CVE-2025-40105, CVE-2025-40107, CVE-2025-40109, CVE-2025-40110, CVE-2025-40111, CVE-2025-40115, CVE-2025-40116, CVE-2025-40118, CVE-2025-40120, CVE-2025-40121, CVE-2025-40127, CVE-2025-40129, CVE-2025-40132, CVE-2025-40133, CVE-2025-40134, CVE-2025-40135, CVE-2025-40139, CVE-2025-40140, CVE-2025-40141, CVE-2025-40142, CVE-2025-40149, CVE-2025-40153, CVE-2025-40154, CVE-2025-40156, CVE-2025-40157, CVE-2025-40158, CVE-2025-40159, CVE-2025-40161, CVE-2025-40162, CVE-2025-40164, CVE-2025-40165, CVE-2025-40166, CVE-2025-40168, CVE-2025-40169, CVE-2025-40171, CVE-2025-40172, CVE-2025-40173, CVE-2025-40175, CVE-2025-40176, CVE-2025-40177, CVE-2025-40178, CVE-2025-40180, CVE-2025-40183, CVE-2025-40185, CVE-2025-40186, CVE-2025-40187, CVE-2025-40188, CVE-2025-40192, CVE-2025-40194, CVE-2025-40196, CVE-2025-40197, CVE-2025-40198, CVE-2025-40200, CVE-2025-40201, CVE-2025-40202, CVE-2025-40203, CVE-2025-40204, CVE-2025-40205, CVE-2025-40206, CVE-2025-40207
Jira References: PED-13611, PED-13949, PED-14062, PED-14115, PED-14353
Sources used:
SUSE Linux Micro Extras 6.2 (src):
 kernel-obs-build-6.12.0-160000.8.1, kernel-syms-6.12.0-160000.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.