Executive brief
A vulnerability in the Linux kernel's LoongArch architecture support could lead to a complete system crash (kernel panic). The issue occurs when the system incorrectly handles memory addresses within specialized background programs (BPF), causing the operating system to attempt to access invalid memory locations. This primarily impacts system availability and could potentially be used by a local attacker to disrupt operations or gain unauthorized access.
Technical details
The vulnerability is located in the BPF JIT compiler for the LoongArch architecture (arch/loongarch/net/bpf_jit.c). Specifically, the BPF trampoline implementation failed to properly sign-extend return values for struct ops according to the LoongArch ABI. When a BPF program (such as bpf_fifo_dequeue) returns a pointer, the system incorrectly treated it as a 32-bit value and sign-extended it to 64-bit in the epilogue, leading to an 'Unable to handle kernel paging request' error and subsequent kernel panic. The fix introduces a sign_extend helper to ensure return values comply with the LoongArch ELF ABI. Patches are available in stable kernel branches.
Affected products
- Linux Linux kernel 6.17, 6.17.3, 6.16.0+
Timeline
- 2025-10-02: patched: Initial patch by Hengqi Chen
- 2025-10-28: disclosed: CVE-2025-40041 published