CVE-2025-29481
MediumCVSS 6.2Summary
A buffer overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog function of libbpf. This has been disputed by third parties who assert that no one in their sane mind should be passing untrusted ELF files into libbpf while running under root.
Risk Assessment
If an application running with elevated privileges processes untrusted ELF files through libbpf, an attacker may exploit the overflow to execute code. However, typical scenarios require an unsafe configuration.
Recommendation
Avoid processing untrusted ELF files through libbpf, especially with root privileges. Monitor the vendor's position on the vulnerability's validity and consider upgrading libbpf.
Other vulnerabilities in libbpf
See all- CVE-2026-80675High
In libbpf, the signed loader does not ensure that a map is exclusive before validating map->sha. Without exclusivity, another BPF program with map access can mutate the contents after freezing, allowing validation on stale data. The fix adds an exclusivity check.
- CVE-2022-49030High
In the libbpf library in the Linux kernel, a size overflow issue was found when mapping ringbuf memory. The maximum ringbuf size on x86-64 hosts is 2GB, so 2 * max_entries can overflow u32 when mapping producer and data pages. The fix casts the size of the read-only mmap region to __u64 and checks for overflow during mmap.
Original NVD description (English source)
Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog` function of libbpf. This has been disputed by third parties who assert that "no one in their sane mind should be passing untrusted ELF files into libbpf while running under root."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS