CVE-2025-38586: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's ARM64 BPF JIT compiler, tracked as CVE-2025-38586. The issue was discovered and disclosed on August 19, 2025, affecting the frame pointer initialization when handling exception boundaries (NVD Database).

The vulnerability occurs in the ARM64 BPF JIT compiler when prog->aux->exception_boundary is set for a BPF program. The find_used_callee_regs() function is not called for programs acting as exception boundaries, even though all callee saved registers are saved. This results in ctx->fp_used remaining false even when the frame pointer is used by the program, leading to improper frame pointer setup in the prologue (NVD Database).

When exploited, this vulnerability can cause the kernel to crash due to a pagefault, potentially leading to system instability and denial of service conditions (NVD Database).

The vulnerability requires the execution of BPF programs with exception boundaries on ARM64 systems. The issue is triggered when the frame pointer is used within these programs but not properly initialized due to the missing setup in the prologue (NVD Database).

The fix involves setting ctx->fp_used = true for exception boundary programs since the frame pointer is always saved in such programs. This ensures proper frame pointer initialization in the prologue (NVD Database).