Executive brief
A vulnerability was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and system monitoring. The issue involves how the system validates memory access when handling socket addresses, potentially leading to kernel warnings or unexpected behavior. While primarily a technical bug, it could affect the stability of systems running specialized BPF programs, including certain industrial controllers from Siemens.
Technical details
The vulnerability exists in the BPF verifier's 'sock_addr_is_valid_access' function. Specifically, the verifier failed to reject accesses to implicit 4-byte padding at offset 60 in the 'bpf_sock_addr' structure (immediately following 'msg_src_ip4'). Because this padding was not explicitly rejected during the initial access check, the verifier would later fail during the context access conversion phase, triggering a kernel warning. An attacker capable of loading BPF programs could exploit this to trigger verifier bugs. The fix involves explicitly checking all valid fields in 'bpf_sock_addr' and rejecting any access to padding or undefined offsets.
Affected products
- Linux Linux Kernel 1cedee13d25a to 6fabca2fc94d (and stable backports)
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later
Timeline
- 2025-09-17: disclosed: Initial patch authored and submitted to BPF maintainers.
- 2025-10-15: patched: Patch committed to Linux stable trees.
- 2025-10-28: advisory: CVE published.
References
- https://git.kernel.org/stable/c/4f00858cd9bbbdf67159e28b85a8ca9e77c83622
- https://git.kernel.org/stable/c/6d8b1a21fd5c34622b0c3893c61e4a38d8ba53ec
- https://git.kernel.org/stable/c/6fabca2fc94d33cdf7ec102058983b086293395f
- https://git.kernel.org/stable/c/76e04bbb4296fb6eac084dbfc27e02ccc744db3e
- https://git.kernel.org/stable/c/ad8b4fe5617e3c85fc23267f02500c4f3bf0ff69
- https://git.kernel.org/stable/c/cdeafacb4f9ff261a96baef519e29480fd7b1019
- https://git.kernel.org/stable/c/de44cdc50d2dce8718cb57deddf9cf1be9a7759f