CVE-2025-39990

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached only through the local `bpf(BPF_PROG_LOAD)` syscall, which is used to submit the crafted program to the verifier. There is no remote or adjacent-network path into `get_helper_proto()`.

AC:LAttack complexity, low

On an affected build the attacker deterministically triggers the bug every time by loading a program that calls a helper whose weak proto is zeroed — no race, no memory-layout dependency, no unpredictable state. Both the `verifier_bug()` WARN path and the `bpf_get_branch_snapshot` inline path are fully under the attacker's control via the program bytecode.

PR:LPrivileges required, low

Program load plus `CAP_PERFMON`/`CAP_BPF` is required, but `CAP_PERFMON` is a narrow, non-root capability commonly granted to unprivileged profiling and BPF observability daemons, and `bpf_token_capable()` explicitly makes it delegable to unprivileged users inside user namespaces via bpffs BPF tokens. This is an ordinary low-privileged account boundary, not init-namespace root.

UI:NUser interaction, none

The attacker loads and exercises the BPF program entirely on their own; no other user or administrator has to perform any action.

S:UScope, unchanged

The corruption and the crash both occur inside the kernel that is already the security authority for the calling process — a conventional local kernel privilege-escalation/DoS, with no VM, IOMMU, or sandbox boundary crossed.

C:HConfidentiality impact, high

With all `arg_type[]` zeroed to `ARG_DONTCARE` the verifier validates nothing, and the inlined `bpf_get_branch_snapshot` copies LBR records (kernel from/to instruction pointers) to an attacker-chosen destination that can be a readable BPF map value, disclosing kernel text addresses and defeating KASLR; the same unvalidated-pointer primitive generalizes to broader kernel memory disclosure.

I:HIntegrity impact, high

`__intel_pmu_snapshot_branch_stack()` performs `memcpy(entries, cpuc->lbr_entries, 24 * cnt)` with `entries` an entirely unvalidated attacker-supplied scalar, giving an arbitrary kernel-memory write of up to several hundred bytes — a direct privilege-escalation primitive.

A:HAvailability impact, high

The common path hits `verifier_bug()` → `BPF_WARN_ONCE`, which taints the kernel and panics outright on the many hardened/production and Android kernels that set `panic_on_warn=1`; the arbitrary-write path trivially oopses the kernel by targeting unmapped or critical memory.