CVE-2025-38528: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; bpf_trace_printk(fmt, sizeof(fmt)); The above BPF program isn't rejected and causes a kernel warning at runtime: Please remove unsupported %\x00 in format string WARNING: CPU: 1 PID: 7244 at lib/vsprintf.c:2680 format_decode+0x49c/0x5d0 This happens because bpf_bprintf_prepare skips over the second %, detected as punctuation, while processing %p. This patch fixes it by not skipping over punctuation. %\x00 is then processed in the next iteration and rejected.

Affected products

• Debian Debian Linux: version 11.0 only
• Linux Linux Kernel: from 5.13, before 5.15.190 (fixed in 5.15.190); from 5.16, before 6.1.147 (fixed in 6.1.147); from 6.2, before 6.6.100 (fixed in 6.6.100); from 6.7, before 6.12.40 (fixed in 6.12.40); from 6.13, before 6.15.8 (fixed in 6.15.8); version 6.16 only

Published 2025-08-16. Last modified 2026-07-30.