CVE-2025-38202 bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Addressed in BPF Security Updates Two new Common Vulnerabilities and Exposures (CVEs) related to the BPF subsystem were published on February 18, 2026. CVE-2025-37884 addresses a deadlock issue between rcu_tasks_trace and event_mutex, while CVE-2025-38202 checks rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem(). These vulnerabilities may affect systems utilizing BPF functionalities. 2 sources 45