Junglewise Threat Intelligence

CVE-2025-40078: Linux Kernel BPF verifier invalid access in bpf_sock_addr

CVE-2025-40078 · Severity: info · CVSS 0 · Published 2025-10-28

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A vulnerability was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and system monitoring. The issue involves how the system validates memory access when handling socket addresses, potentially leading to kernel warnings or unexpected behavior. While primarily a technical bug, it could affect the stability of systems running specialized BPF programs, including certain industrial controllers from Siemens.

Technical details

The vulnerability exists in the BPF verifier's 'sock_addr_is_valid_access' function. Specifically, the verifier failed to reject accesses to implicit 4-byte padding at offset 60 in the 'bpf_sock_addr' structure (immediately following 'msg_src_ip4'). Because this padding was not explicitly rejected during the initial access check, the verifier would later fail during the context access conversion phase, triggering a kernel warning. An attacker capable of loading BPF programs could exploit this to trigger verifier bugs. The fix involves explicitly checking all valid fields in 'bpf_sock_addr' and rejecting any access to padding or undefined offsets.

Affected products

  • Linux Linux Kernel 1cedee13d25a to 6fabca2fc94d (and stable backports)
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later

Timeline

  • 2025-09-17: disclosed: Initial patch authored and submitted to BPF maintainers.
  • 2025-10-15: patched: Patch committed to Linux stable trees.
  • 2025-10-28: advisory: CVE published.

References

Related threats