Riskcovery

CVE-2025-40169

bpf: Reject negative offsets for ALU ops

State
Published
Severity
7.8 High
Published
Nov 12, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative offsets for ALU ops

When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer.

The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1).

This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ec0e2da95f72d4a46050a4d994e4fe471474fd80 to before 3bce44b344040e5eef3d64d38b157c15304c0aabAffected
  • ec0e2da95f72d4a46050a4d994e4fe471474fd80 to before 5017c302ca4b2a45149ad64e058fa2d5623c068fAffected
  • ec0e2da95f72d4a46050a4d994e4fe471474fd80 to before 21167bf70dbe400563e189ac632258d35eda38b5Affected
  • ec0e2da95f72d4a46050a4d994e4fe471474fd80 to before 55c0ced59fe17dee34e9dfd5f7be63cbab207758Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.112 through 6.6.*Not affected
  • 6.12.53 through 6.12.*Not affected
  • 6.17.3 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.