CVE-2025-38012: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability (CVE-2025-38012) was identified in the Linux kernel's schedext subsystem, specifically in the bpf_iter_scx_dsq_new() function's initialization of iterators. The vulnerability was initially discovered and disclosed on April 16, 2025. This issue affects the Linux kernel's BPF subsystem (CVE MITRE, NVD).

The vulnerability occurs when BPF programs call next() and destroy() on BPF iterators after new() returns an error value. Specifically, the bpf_iter_scx_dsq_new() function could leave the iterator in an uninitialized state after an error return, which causes bpf_iter_scx_dsq_next() to dereference garbage data. This happens because the bpf_for_each() macro ignores error returns from new() (NVD, Wiz).

When exploited, this vulnerability can lead to the dereferencing of uninitialized memory, potentially causing system instability or crashes due to accessing garbage data (Wiz).

The vulnerability has been addressed by modifying bpf_iter_scx_dsq_new() to always clear $kit->dsq, ensuring that next() and destroy() operations become noops when called after an error return (CVE MITRE).